{"id":"CVE-2026-98660","title":"iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup\n\nThe sampling frequency tables store each frequency as an integer part and\na fractional par…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 9db6684fab228edd3b8861a172ccbce3236f027a","Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 4fd5a61e61d6899cbd45728a5fceba49a53c222d","Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 7dbb518f3328ebd9d5c6e970b4befad6deb5c7f1","Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 56c423b233b214182c58c99861899327b45b0d6c","Linux 6.1"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:44:19.707Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98660","references":[{"url":"https://git.kernel.org/stable/c/9db6684fab228edd3b8861a172ccbce3236f027a"},{"url":"https://git.kernel.org/stable/c/4fd5a61e61d6899cbd45728a5fceba49a53c222d"},{"url":"https://git.kernel.org/stable/c/7dbb518f3328ebd9d5c6e970b4befad6deb5c7f1"},{"url":"https://git.kernel.org/stable/c/56c423b233b214182c58c99861899327b45b0d6c"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.535Z","slug":"CVE-2026-98660","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup\n\nThe sampling frequency tables store each frequency as an integer part and\na fractional part in micro units. num_sampling_freq_avail is initialized\nto the number of flattened integer elements because read_avail() returns\nthe table as a flat array.\n\nbmp280_write_sampling_frequency(), however, indexes the same table as a\ntwo-dimensional array and uses num_sampling_freq_avail as the number of\nrows. Convert the flattened element count back to the number of rows\nbefore iterating over the table.\n\n## Affected\n\n- `Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 9db6684fab228edd3b8861a172ccbce3236f027a`\n- `Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 4fd5a61e61d6899cbd45728a5fceba49a53c222d`\n- `Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 7dbb518f3328ebd9d5c6e970b4befad6deb5c7f1`\n- `Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 56c423b233b214182c58c99861899327b45b0d6c`\n- `Linux 6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}