Vulnerability-Lookup

GHSA-C7XC-QXG6-9546

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling

ams_event_to_channel() may return a pointer past the end of dev->channels when no matching scan_index is found. This can lead to invalid memory access in ams_handle_event().

Add a bounds check in ams_event_to_channel() and return NULL when no channel is found. Also guard the caller to safely handle this case.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72480"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:22Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\n\nams_event_to_channel() may return a pointer past the end of\ndev-\u003echannels when no matching scan_index is found. This can lead\nto invalid memory access in ams_handle_event().\n\nAdd a bounds check in ams_event_to_channel() and return NULL when\nno channel is found. Also guard the caller to safely handle this\ncase.",
  "id": "GHSA-c7xc-qxg6-9546",
  "modified": "2026-08-17T06:33:32Z",
  "published": "2026-08-15T06:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72480"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-72480 (GCVE-0-2026-72480)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44

Title

iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling

Summary

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling ams_event_to_channel() may return a pointer past the end of dev->channels when no matching scan_index is found. This can lead to invalid memory access in ams_handle_event(). Add a bounds check in ams_event_to_channel() and return NULL when no channel is found. Also guard the caller to safely handle this case.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/116d1f8805ae2daad…
https://git.kernel.org/stable/c/94d158985b6ea011b…
https://git.kernel.org/stable/c/1d24f14e049fdd769…
https://git.kernel.org/stable/c/9ac3675bf875792dc…
https://git.kernel.org/stable/c/3c374d33f1338dbb5…
https://git.kernel.org/stable/c/947eb6f0a274f8b15…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 116d1f8805ae2daadbac89d24da4c0da50b9edae (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 94d158985b6ea011bdc26186f42d662a156da6cb (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 1d24f14e049fdd769146dda026496ed23b397ed9 (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 9ac3675bf875792dced45efbf47116719a7c097b (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 3c374d33f1338dbb5676919c5194caa9c5aa1631 (git) Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 947eb6f0a274f8b15a0248051a65b069effd5057 (git)
Linux	Linux	Affected: 5.17 Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "116d1f8805ae2daadbac89d24da4c0da50b9edae",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "94d158985b6ea011bdc26186f42d662a156da6cb",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "1d24f14e049fdd769146dda026496ed23b397ed9",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "9ac3675bf875792dced45efbf47116719a7c097b",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "3c374d33f1338dbb5676919c5194caa9c5aa1631",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "947eb6f0a274f8b15a0248051a65b069effd5057",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\n\nams_event_to_channel() may return a pointer past the end of\ndev-\u003echannels when no matching scan_index is found. This can lead\nto invalid memory access in ams_handle_event().\n\nAdd a bounds check in ams_event_to_channel() and return NULL when\nno channel is found. Also guard the caller to safely handle this\ncase."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the Xilinx ZynqMP AMS IIO platform driver and is reached from a hardware AMS alarm IRQ after local IIO sysfs or /dev/iio:device* threshold-event configuration; it is not exposed through any network-facing kernel service.\nAC:L - A local actor with IIO event write access can enable AMS threshold alarms, program thresholds, and repeatedly trigger the interrupt path; on common ZynqMP boards with partial PL channel tables, SYSMON can assert alarm status bits that lack a matching dev-\u003echannels entry when the ISR is handled.\nPR:L - Exploitation requires local access to configure or interact with the xilinx-ams IIO device (sysfs event enable/threshold writes or an open event character device); it does not require init-namespace root, only a local account with device access typical on embedded ZynqMP monitoring stacks.\nUI:N - After AMS threshold monitoring is enabled (commonly at boot on industrial, automotive, and aerospace ZynqMP systems), the vulnerable code runs automatically on hardware alarm interrupts without any additional victim action at exploitation time.\nS:U - Impact is confined to kernel memory safety and IIO event handling within the same host OS security boundary; this is not a VM escape, hypervisor bypass, or cross-tenant boundary crossing.\nC:H - ams_event_to_channel() returns a pointer one element past dev-\u003echannels, and ams_handle_event() performs out-of-bounds reads of struct iio_chan_spec fields that are fed into iio_push_event(), enabling disclosure of adjacent kernel memory to userspace event readers.\nI:H - The out-of-bounds iio_chan_spec dereference reads attacker-influenced adjacent kernel memory used to drive iio_push_event() control flow and event metadata, which is a memory-safety violation with potential for further kernel compromise beyond simple denial of service.\nA:H - Processing an alarm index with no matching channel causes invalid kernel memory access in interrupt context, which can produce a kernel oops or panic and deny service on safety-critical embedded controllers relying on AMS monitoring."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:43.931Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae"
        },
        {
          "url": "https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631"
        },
        {
          "url": "https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057"
        }
      ],
      "title": "iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72480",
    "datePublished": "2026-08-15T05:57:18.975Z",
    "dateReserved": "2026-08-09T03:40:39.935Z",
    "dateUpdated": "2026-08-17T05:44:43.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-C7XC-QXG6-9546

CVE-2026-72480 (GCVE-0-2026-72480)

Tags

Sightings

Nomenclature