CVE-2026-98680 iio: accel: kionix-kx022a: Prevent memory leak and fix state
A memory leak and state inconsistency in the Kionix accelerometer driver can lead to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98680?
CVE-2026-98680 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: accel: kionix-kx022a: Prevent memory leak and fix state
The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022a_fifo_enable() at the buffer enable path, the allocated memory is never freed. Furthermore, the state information and previous hardware configuration(s) aren't undone, potentially leaving WMI interrupts and buffers enabled, or driver state flags wrong.
Free the memory and revert the hardware configuration and state flags on error path.
Which versions are affected by CVE-2026-98680?
How do I fix CVE-2026-98680?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98680 being exploited?
There is no known exploitation of CVE-2026-98680 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98680, DEBIAN-CVE-2026-98680, GHSA-qmhh-5mg8-h75r, UBUNTU-CVE-2026-98680.