Description
In the Linux kernel, the following vulnerability has been resolved:

iio: accel: kionix-kx022a: Prevent memory leak and fix state

The driver allocates memory for samples at buffer enable path. If regmap
operation fails in the kx022a_fifo_enable() at the buffer enable path, the
allocated memory is never freed. Furthermore, the state information and
previous hardware configuration(s) aren't undone, potentially leaving
WMI interrupts and buffers enabled, or driver state flags wrong.

Free the memory and revert the hardware configuration and state flags on
error path.
Published: 2026-10-18
Score: 1.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: Memory Leak and Incorrect Driver State
Action: Patch
AI Analysis

Impact

The kionix-kx022a driver allocates memory for sensor samples when a buffer is enabled. If a regmap operation fails during this enable path, the newly‑allocated memory is never released, producing a memory leak. Additionally, the driver does not revert the hardware configuration or reset internal state flags on this error path, leaving interrupts and buffers enabled and driver flags in an inconsistent state. This flaw involves improper resource management (CWE‑772).

Affected Systems

The flaw exists in the Linux kernel’s iio subsystem driver for the Kionix KX022A accelerometer. Any Linux distribution shipping a kernel that includes this driver in its iio module is affected; no specific kernel version range is listed, so the issue applies to all kernels containing the unpatched driver.

Risk and Exploitability

The CVSS score of 1.9 and EPSS of less than 1% indicate low severity and low exploitation likelihood. The weakness is local; an attacker with sufficient privileges to enable the IIO buffer can repeatedly trigger the error path, potentially exhausting memory and causing a denial‑of‑service. The vulnerability is not listed in CISA KEV.

Generated by OpenCVE AI on October 23, 2026 at 05:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the kernel to a version that contains the commit fixing the memory leak and state cleanup.
  • Reboot the system or reload the iio module after the kernel update to apply the new driver code.
  • If an upgrade is not immediately possible, disable the IIO buffer for the Kionix KX022A device or manually reset the hardware configuration to clear enabled interrupts and buffers thereby reducing the risk of memory exhaustion.

Generated by OpenCVE AI on October 23, 2026 at 05:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4850-1 linux-6.12 security update
History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-789

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References
Metrics threat_severity

None

cvssV3_1

{'score': 1.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Low


Sun, 18 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-789

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022a_fifo_enable() at the buffer enable path, the allocated memory is never freed. Furthermore, the state information and previous hardware configuration(s) aren't undone, potentially leaving WMI interrupts and buffers enabled, or driver state flags wrong. Free the memory and revert the hardware configuration and state flags on error path.
Title iio: accel: kionix-kx022a: Prevent memory leak and fix state
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:23:49.667Z

Reserved: 2026-09-25T10:25:14.364Z

Link: CVE-2026-98680

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:21.357

Modified: 2026-10-19T10:19:32.447

Link: CVE-2026-98680

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98680 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T05:15:14Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime