CVE-2026-31764 iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
A local attacker can trigger an out-of-bounds memory access in the st_lsm6dsx driver by writing to a sysfs attribute, potentially causing a crash or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31764?
CVE-2026-31764 is a high-severity memory corruption vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
The st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace writes the buffer sampling frequency sysfs attribute, calls st_lsm6dsx_check_odr(), which accesses the odr_table array at index `sensor->id`; since this array is only 2 entries long, an access for any sensor type other than accelerometer or gyroscope is an out-of-bounds access.
The motivation for being able to set a buffer frequency different from the sensor sampling frequency is to support use cases that need accurate event detection (which requires a high sampling frequency) while retrieving sensor data at low frequency. Since all the supported event types are generated from acceleration data only, do not create the buffer sampling frequency attribute for sensor types other than the accelerometer.
Weakness: CWE-129
Which versions are affected by CVE-2026-31764?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31764?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31764 being exploited?
There is no known exploitation of CVE-2026-31764 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-31764, GHSA-f6pj-wrqm-mccq, UBUNTU-CVE-2026-31764.