{"id":"CVE-2025-39719","state":"PUBLISHED","title":"iio: imu: bno055: fix OOB access of hw_xlate array","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: bno055: fix OOB access of hw_xlate array\n\nFix a potential out-of-bounds array access of the hw_xlate array in\nbno055.c.\n\nIn bno055_get_regmask(), hw_xlate was iterated over the length of the\nvals array instead of the length of the hw_xlate array. In the case of\nbno055_gyr_scale, the vals array is larger than the hw_xlate array,\nso this could result in an out-of-bounds access. In practice, this\nshouldn't happen though because a match should always be found which\nbreaks out of the for loop before it iterates beyond the end of the\nhw_xlate array.\n\nBy adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be\nsure we are iterating over the correct length.","publishedAt":"2025-09-05T17:21:26.952Z","updatedAt":"2026-05-12T12:06:35.861Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"a0691ab6334f1769acc64ea9e319414a682ff45d","versionType":"git"},{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"50e823a23816b792daf6e8405f8d6045952bb90e","versionType":"git"},{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"4808ca3aa30ae857454d0b41d2d0bf161a312b45","versionType":"git"},{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"5c2b601922c064f7be70ae8621277f18d1ffec59","versionType":"git"},{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"399b883ec828e436f1a721bf8551b4da8727e65b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/bno055/bno055.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"6.1.149","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.103","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.44","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.4","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/bno055/bno055.c"]}],"references":["https://git.kernel.org/stable/c/a0691ab6334f1769acc64ea9e319414a682ff45d","https://git.kernel.org/stable/c/50e823a23816b792daf6e8405f8d6045952bb90e","https://git.kernel.org/stable/c/4808ca3aa30ae857454d0b41d2d0bf161a312b45","https://git.kernel.org/stable/c/5c2b601922c064f7be70ae8621277f18d1ffec59","https://git.kernel.org/stable/c/399b883ec828e436f1a721bf8551b4da8727e65b","https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/39xxx/CVE-2025-39719.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39719","state":"PUBLISHED","datePublished":"2025-09-05T17:21:26.952Z","dateUpdated":"2026-05-12T12:06:35.861Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.117Z"},"containers":{"cna":{"title":"iio: imu: bno055: fix OOB access of hw_xlate array","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: bno055: fix OOB access of hw_xlate array\n\nFix a potential out-of-bounds array access of the hw_xlate array in\nbno055.c.\n\nIn bno055_get_regmask(), hw_xlate was iterated over the length of the\nvals array instead of the length of the hw_xlate array. In the case of\nbno055_gyr_scale, the vals array is larger than the hw_xlate array,\nso this could result in an out-of-bounds access. In practice, this\nshouldn't happen though because a match should always be found which\nbreaks out of the for loop before it iterates beyond the end of the\nhw_xlate array.\n\nBy adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be\nsure we are iterating over the correct length."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"a0691ab6334f1769acc64ea9e319414a682ff45d","versionType":"git"},{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"50e823a23816b792daf6e8405f8d6045952bb90e","versionType":"git"},{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"4808ca3aa30ae857454d0b41d2d0bf161a312b45","versionType":"git"},{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"5c2b601922c064f7be70ae8621277f18d1ffec59","versionType":"git"},{"version":"4aefe1c2bd0cb0223130671d459cd16efa3d3462","status":"affected","lessThan":"399b883ec828e436f1a721bf8551b4da8727e65b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/bno055/bno055.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"6.1.149","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.103","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.44","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.4","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/bno055/bno055.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a0691ab6334f1769acc64ea9e319414a682ff45d"},{"url":"https://git.kernel.org/stable/c/50e823a23816b792daf6e8405f8d6045952bb90e"},{"url":"https://git.kernel.org/stable/c/4808ca3aa30ae857454d0b41d2d0bf161a312b45"},{"url":"https://git.kernel.org/stable/c/5c2b601922c064f7be70ae8621277f18d1ffec59"},{"url":"https://git.kernel.org/stable/c/399b883ec828e436f1a721bf8551b4da8727e65b"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:34:56.333Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.6.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.12.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.16.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:42:44.953Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V5.0","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-05-12T12:06:35.861Z"},"x_adpType":"supplier"}]}}}