Vulnerability-Lookup

FKIE_CVE-2026-72480

Vulnerability from fkie_nvd - Published: 2026-08-15 06:22 - Updated: 2026-08-17 06:19

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling ams_event_to_channel() may return a pointer past the end of dev->channels when no matching scan_index is found. This can lead to invalid memory access in ams_handle_event(). Add a bounds check in ams_event_to_channel() and return NULL when no channel is found. Also guard the caller to safely handle this case.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "116d1f8805ae2daadbac89d24da4c0da50b9edae",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "94d158985b6ea011bdc26186f42d662a156da6cb",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "1d24f14e049fdd769146dda026496ed23b397ed9",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "9ac3675bf875792dced45efbf47116719a7c097b",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "3c374d33f1338dbb5676919c5194caa9c5aa1631",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "947eb6f0a274f8b15a0248051a65b069effd5057",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\n\nams_event_to_channel() may return a pointer past the end of\ndev-\u003echannels when no matching scan_index is found. This can lead\nto invalid memory access in ams_handle_event().\n\nAdd a bounds check in ams_event_to_channel() and return NULL when\nno channel is found. Also guard the caller to safely handle this\ncase."
    }
  ],
  "id": "CVE-2026-72480",
  "lastModified": "2026-08-17T06:19:16.100",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-15T06:22:22.210",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-72480 (GCVE-0-2026-72480)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44

Title

iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

6 references

URL	Tags
https://git.kernel.org/stable/c/116d1f8805ae2daad…
https://git.kernel.org/stable/c/94d158985b6ea011b…
https://git.kernel.org/stable/c/1d24f14e049fdd769…
https://git.kernel.org/stable/c/9ac3675bf875792dc…
https://git.kernel.org/stable/c/3c374d33f1338dbb5…
https://git.kernel.org/stable/c/947eb6f0a274f8b15…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 116d1f8805ae2daadbac89d24da4c0da50b9edae (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 94d158985b6ea011bdc26186f42d662a156da6cb (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 1d24f14e049fdd769146dda026496ed23b397ed9 (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 9ac3675bf875792dced45efbf47116719a7c097b (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 3c374d33f1338dbb5676919c5194caa9c5aa1631 (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 947eb6f0a274f8b15a0248051a65b069effd5057 (git)
Linux	Linux	Affected: 5.17 Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "116d1f8805ae2daadbac89d24da4c0da50b9edae",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "94d158985b6ea011bdc26186f42d662a156da6cb",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "1d24f14e049fdd769146dda026496ed23b397ed9",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "9ac3675bf875792dced45efbf47116719a7c097b",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "3c374d33f1338dbb5676919c5194caa9c5aa1631",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "947eb6f0a274f8b15a0248051a65b069effd5057",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\n\nams_event_to_channel() may return a pointer past the end of\ndev-\u003echannels when no matching scan_index is found. This can lead\nto invalid memory access in ams_handle_event().\n\nAdd a bounds check in ams_event_to_channel() and return NULL when\nno channel is found. Also guard the caller to safely handle this\ncase."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the Xilinx ZynqMP AMS IIO platform driver and is reached from a hardware AMS alarm IRQ after local IIO sysfs or /dev/iio:device* threshold-event configuration; it is not exposed through any network-facing kernel service.\nAC:L - A local actor with IIO event write access can enable AMS threshold alarms, program thresholds, and repeatedly trigger the interrupt path; on common ZynqMP boards with partial PL channel tables, SYSMON can assert alarm status bits that lack a matching dev-\u003echannels entry when the ISR is handled.\nPR:L - Exploitation requires local access to configure or interact with the xilinx-ams IIO device (sysfs event enable/threshold writes or an open event character device); it does not require init-namespace root, only a local account with device access typical on embedded ZynqMP monitoring stacks.\nUI:N - After AMS threshold monitoring is enabled (commonly at boot on industrial, automotive, and aerospace ZynqMP systems), the vulnerable code runs automatically on hardware alarm interrupts without any additional victim action at exploitation time.\nS:U - Impact is confined to kernel memory safety and IIO event handling within the same host OS security boundary; this is not a VM escape, hypervisor bypass, or cross-tenant boundary crossing.\nC:H - ams_event_to_channel() returns a pointer one element past dev-\u003echannels, and ams_handle_event() performs out-of-bounds reads of struct iio_chan_spec fields that are fed into iio_push_event(), enabling disclosure of adjacent kernel memory to userspace event readers.\nI:H - The out-of-bounds iio_chan_spec dereference reads attacker-influenced adjacent kernel memory used to drive iio_push_event() control flow and event metadata, which is a memory-safety violation with potential for further kernel compromise beyond simple denial of service.\nA:H - Processing an alarm index with no matching channel causes invalid kernel memory access in interrupt context, which can produce a kernel oops or panic and deny service on safety-critical embedded controllers relying on AMS monitoring."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:43.931Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae"
        },
        {
          "url": "https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631"
        },
        {
          "url": "https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057"
        }
      ],
      "title": "iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72480",
    "datePublished": "2026-08-15T05:57:18.975Z",
    "dateReserved": "2026-08-09T03:40:39.935Z",
    "dateUpdated": "2026-08-17T05:44:43.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted