In the Linux kernel, the following vulnerability has been resolved:
iio: chemical: mhz19b: reject oversized serial replies
mhz19b_receive_buf() appends each serdev chunk into the fixed
MHZ19B_CMD_SIZE receive buffer and advances buf_idx by len without
checking that the chunk fits in the remaining space. A large callback
can therefore overflow st->buf before the command path validates the
reply.
Reset the reply state before each command and reject oversized serial
replies before copying them into the fixed buffer. When an oversized
reply is detected, wake the waiter and report -EMSGSIZE instead of
overwriting st->buf.
References
Configurations
Configuration 1 (hide)
|
History
30 Oct 2026, 14:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/673478bc29cf72010faaf293c1c8c667393335a0 - Patch | |
| References | () https://git.kernel.org/stable/c/a5a05410cb34bfa486d63684cdc1f87a3b13f20a - Patch | |
| References | () https://git.kernel.org/stable/c/ea69e7a6efa88ef32090a91064c362738cc19ddd - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux linux Kernel
Linux |
|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-30 14:28
NVD link : CVE-2026-63932
Mitre link : CVE-2026-63932
CVE.ORG link : CVE-2026-63932
JSON object : View
Products Affected
linux
- linux_kernel
CWE