SB20261022247 - Return of Wrong Status Code in Linux kernel iio pressure driver

Description

This security bulletin contains information about 1 vulnerability.

1) Return of Wrong Status Code (CVE-ID: CVE-2026-98659)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain invalid pressure sensor data reported as successfully read when a sensor read fails.

The vulnerability exists due to incorrect error status reporting in the Linux kernel's bm1390_read_data() function when reading pressure sensor data. A local user can request a sensor reading that encounters a read error and receive a success status despite the invalid data, because the function unconditionally returns zero instead of the cached error value.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/493e743ea1b5930bfa0c6c25b46add6c5d5323db
• https://git.kernel.org/stable/c/6280d15f08603230855cf667d1cf67e7e94f693c
• https://git.kernel.org/stable/c/b0e951ffc5a28141a106562997ca136ec6a0e1a3