---
id: CVE-2026-98660
title: 'iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

  The sampling frequency tables store each frequency as an integer part and
  a fractional par…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 <
    9db6684fab228edd3b8861a172ccbce3236f027a
  - >-
    Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 <
    4fd5a61e61d6899cbd45728a5fceba49a53c222d
  - >-
    Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 <
    7dbb518f3328ebd9d5c6e970b4befad6deb5c7f1
  - >-
    Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 <
    56c423b233b214182c58c99861899327b45b0d6c
  - Linux 6.1
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:44:19.707Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98660'
references:
  - url: 'https://git.kernel.org/stable/c/9db6684fab228edd3b8861a172ccbce3236f027a'
  - url: 'https://git.kernel.org/stable/c/4fd5a61e61d6899cbd45728a5fceba49a53c222d'
  - url: 'https://git.kernel.org/stable/c/7dbb518f3328ebd9d5c6e970b4befad6deb5c7f1'
  - url: 'https://git.kernel.org/stable/c/56c423b233b214182c58c99861899327b45b0d6c'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.535Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

The sampling frequency tables store each frequency as an integer part and
a fractional part in micro units. num_sampling_freq_avail is initialized
to the number of flattened integer elements because read_avail() returns
the table as a flat array.

bmp280_write_sampling_frequency(), however, indexes the same table as a
two-dimensional array and uses num_sampling_freq_avail as the number of
rows. Convert the flattened element count back to the number of rows
before iterating over the table.

## Affected

- `Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 9db6684fab228edd3b8861a172ccbce3236f027a`
- `Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 4fd5a61e61d6899cbd45728a5fceba49a53c222d`
- `Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 7dbb518f3328ebd9d5c6e970b4befad6deb5c7f1`
- `Linux >= 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 < 56c423b233b214182c58c99861899327b45b0d6c`
- `Linux 6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.