SB20261022276 - Memory leak in Linux kernel iio accel driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-98680)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory leaks and potentially disrupt accelerometer operation.

The vulnerability exists due to missing memory cleanup and incomplete state restoration in the Linux kernel kionix-kx022a accelerometer driver's kx022a_fifo_enable() function when register operations fail during buffer enablement. A local user can attempt to enable buffered sampling under these failure conditions to leak allocated sample memory and potentially leave interrupts, hardware buffers, or driver state flags incorrectly configured.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2ef953f7b54e1460718116b4c0a4c63b106348fc
• https://git.kernel.org/stable/c/5c7ca8fe72064c1c3c7a7418031f692bb2bff260
• https://git.kernel.org/stable/c/e3bc345d08639e62b629e0ec0799f7fb45e21372
• https://git.kernel.org/stable/c/e65e128b51a37dd1a9056ac3d1705d805a5c8bb0