CVE-2025-71198 iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
A local attacker can cause a kernel crash by configuring unsupported accelerometer wakeup events on specific ST sensors due to a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71198?
CVE-2025-71198 is a vulnerability in Linux, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, indicating support for IIO events. However, event detection is not supported for all sensors, and if userspace tries to configure accelerometer wakeup events on a sensor device that does not support them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL pointer when trying to write to the wakeup register. Define an additional struct iio_chan_spec array whose members have a NULL event_spec field, and use this array instead of st_lsm6dsx_acc_channels for sensors without event detection capability.
Which versions are affected by CVE-2025-71198?
How do I fix CVE-2025-71198?
Apply the vendor's patch.
Is CVE-2025-71198 being exploited?
There is no known exploitation of CVE-2025-71198 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-71198, DEBIAN-CVE-2025-71198, GHSA-ph76-p2v9-4hmx, ROOT-OS-DEBIAN-11-CVE-2025-71198, ROOT-OS-DEBIAN-12-CVE-2025-71198, ROOT-OS-UBUNTU-2204-CVE-2025-71198 and 2 more.