CVE-2026-31764

Vulnerability

The Linux kernel's ST LSM6DSX IMU driver contains an out-of-bounds (OOB) access vulnerability in the st_lsm6dsx_hwfifo_odr_store() function. This function is invoked when userspace writes to the buffer sampling frequency sysfs attribute. It calls st_lsm6dsx_check_odr(), which indexes the odr_table array using sensor->id. The array is only two entries long, designed for accelerometer and gyroscope IDs. For any other sensor type, the access goes beyond the array bounds [1], [2].

Exploitation

The vulnerability can be triggered by writing to the buffer sampling frequency sysfs attribute of a sensor type other than accelerometer or gyroscope. This requires local access to the system and the ability to interact with the IIO subsystem, but no special privileges are needed for the write itself. The OOB read/write occurs in kernel space, potentially leading to memory corruption.

Impact

An attacker exploiting this vulnerability could cause a kernel crash (denial of service) or potentially elevate privileges by corrupting kernel memory. The specific impact depends on the memory layout and the attacker's ability to control the out-of-bounds index.

Mitigation

The fix, already applied in stable kernel commits, removes the buffer sampling frequency attribute for all sensor types except the accelerometer [1], [2]. Users are advised to update their kernels to include these patches.