GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72480 (GCVE-0-2026-72480)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
Summary
In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling ams_event_to_channel() may return a pointer past the end of dev->channels when no matching scan_index is found. This can lead to invalid memory access in ams_handle_event(). Add a bounds check in ams_event_to_channel() and return NULL when no channel is found. Also guard the caller to safely handle this case.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 116d1f8805ae2daadbac89d24da4c0da50b9edae (git)
Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 94d158985b6ea011bdc26186f42d662a156da6cb (git)
Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 1d24f14e049fdd769146dda026496ed23b397ed9 (git)
Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 9ac3675bf875792dced45efbf47116719a7c097b (git)
Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 3c374d33f1338dbb5676919c5194caa9c5aa1631 (git)
Affected: d5c70627a79455154f5f636096abe6fe57510605 , < 947eb6f0a274f8b15a0248051a65b069effd5057 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "116d1f8805ae2daadbac89d24da4c0da50b9edae",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "94d158985b6ea011bdc26186f42d662a156da6cb",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "1d24f14e049fdd769146dda026496ed23b397ed9",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "9ac3675bf875792dced45efbf47116719a7c097b",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "3c374d33f1338dbb5676919c5194caa9c5aa1631",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "947eb6f0a274f8b15a0248051a65b069effd5057",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\n\nams_event_to_channel() may return a pointer past the end of\ndev-\u003echannels when no matching scan_index is found. This can lead\nto invalid memory access in ams_handle_event().\n\nAdd a bounds check in ams_event_to_channel() and return NULL when\nno channel is found. Also guard the caller to safely handle this\ncase."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the Xilinx ZynqMP AMS IIO platform driver and is reached from a hardware AMS alarm IRQ after local IIO sysfs or /dev/iio:device* threshold-event configuration; it is not exposed through any network-facing kernel service.\nAC:L - A local actor with IIO event write access can enable AMS threshold alarms, program thresholds, and repeatedly trigger the interrupt path; on common ZynqMP boards with partial PL channel tables, SYSMON can assert alarm status bits that lack a matching dev-\u003echannels entry when the ISR is handled.\nPR:L - Exploitation requires local access to configure or interact with the xilinx-ams IIO device (sysfs event enable/threshold writes or an open event character device); it does not require init-namespace root, only a local account with device access typical on embedded ZynqMP monitoring stacks.\nUI:N - After AMS threshold monitoring is enabled (commonly at boot on industrial, automotive, and aerospace ZynqMP systems), the vulnerable code runs automatically on hardware alarm interrupts without any additional victim action at exploitation time.\nS:U - Impact is confined to kernel memory safety and IIO event handling within the same host OS security boundary; this is not a VM escape, hypervisor bypass, or cross-tenant boundary crossing.\nC:H - ams_event_to_channel() returns a pointer one element past dev-\u003echannels, and ams_handle_event() performs out-of-bounds reads of struct iio_chan_spec fields that are fed into iio_push_event(), enabling disclosure of adjacent kernel memory to userspace event readers.\nI:H - The out-of-bounds iio_chan_spec dereference reads attacker-influenced adjacent kernel memory used to drive iio_push_event() control flow and event metadata, which is a memory-safety violation with potential for further kernel compromise beyond simple denial of service.\nA:H - Processing an alarm index with no matching channel causes invalid kernel memory access in interrupt context, which can produce a kernel oops or panic and deny service on safety-critical embedded controllers relying on AMS monitoring."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:43.931Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae"
        },
        {
          "url": "https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631"
        },
        {
          "url": "https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057"
        }
      ],
      "title": "iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72480",
    "datePublished": "2026-08-15T05:57:18.975Z",
    "dateReserved": "2026-08-09T03:40:39.935Z",
    "dateUpdated": "2026-08-17T05:44:43.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72480",
      "date": "2026-09-11",
      "epss": "0.00129",
      "percentile": "0.02886"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72480\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:22.210\",\"lastModified\":\"2026-08-17T06:19:16.100\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\\n\\nams_event_to_channel() may return a pointer past the end of\\ndev-\u003echannels when no matching scan_index is found. This can lead\\nto invalid memory access in ams_handle_event().\\n\\nAdd a bounds check in ams_event_to_channel() and return NULL when\\nno channel is found. Also guard the caller to safely handle this\\ncase.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iio/adc/xilinx-ams.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d5c70627a79455154f5f636096abe6fe57510605\",\"lessThan\":\"116d1f8805ae2daadbac89d24da4c0da50b9edae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5c70627a79455154f5f636096abe6fe57510605\",\"lessThan\":\"94d158985b6ea011bdc26186f42d662a156da6cb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5c70627a79455154f5f636096abe6fe57510605\",\"lessThan\":\"1d24f14e049fdd769146dda026496ed23b397ed9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5c70627a79455154f5f636096abe6fe57510605\",\"lessThan\":\"9ac3675bf875792dced45efbf47116719a7c097b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5c70627a79455154f5f636096abe6fe57510605\",\"lessThan\":\"3c374d33f1338dbb5676919c5194caa9c5aa1631\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5c70627a79455154f5f636096abe6fe57510605\",\"lessThan\":\"947eb6f0a274f8b15a0248051a65b069effd5057\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iio/adc/xilinx-ams.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:08:19+00:00",
      "cve": "CVE-2026-72480",
      "id": "CVE-2026-72480",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72480.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.