GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-71198 (GCVE-0-2025-71198)

Vulnerability from cvelistv5 – Published: 2026-02-04 16:07 – Updated: 2026-05-11 21:56
VLAI
Title
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
Summary
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, indicating support for IIO events. However, event detection is not supported for all sensors, and if userspace tries to configure accelerometer wakeup events on a sensor device that does not support them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL pointer when trying to write to the wakeup register. Define an additional struct iio_chan_spec array whose members have a NULL event_spec field, and use this array instead of st_lsm6dsx_acc_channels for sensors without event detection capability.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b5969abfa8b8ed43ebd93479d394f664bd4a5a87 , < 7673167fac9323110973a3300637adba7d45de3a (git)
Affected: b5969abfa8b8ed43ebd93479d394f664bd4a5a87 , < 4d60ffcdedfe2cdb68a1cde19bb292bc67451629 (git)
Affected: b5969abfa8b8ed43ebd93479d394f664bd4a5a87 , < 81ed6e42d6e555dd978c9dd5e3f7c20cb121221b (git)
Affected: b5969abfa8b8ed43ebd93479d394f664bd4a5a87 , < c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 6.6.122 , ≤ 6.6.* (semver)
Unaffected: 6.12.68 , ≤ 6.12.* (semver)
Unaffected: 6.18.8 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7673167fac9323110973a3300637adba7d45de3a",
              "status": "affected",
              "version": "b5969abfa8b8ed43ebd93479d394f664bd4a5a87",
              "versionType": "git"
            },
            {
              "lessThan": "4d60ffcdedfe2cdb68a1cde19bb292bc67451629",
              "status": "affected",
              "version": "b5969abfa8b8ed43ebd93479d394f664bd4a5a87",
              "versionType": "git"
            },
            {
              "lessThan": "81ed6e42d6e555dd978c9dd5e3f7c20cb121221b",
              "status": "affected",
              "version": "b5969abfa8b8ed43ebd93479d394f664bd4a5a87",
              "versionType": "git"
            },
            {
              "lessThan": "c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3",
              "status": "affected",
              "version": "b5969abfa8b8ed43ebd93479d394f664bd4a5a87",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.68",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection\n\nThe st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL\nevent_spec field, indicating support for IIO events. However, event\ndetection is not supported for all sensors, and if userspace tries to\nconfigure accelerometer wakeup events on a sensor device that does not\nsupport them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL\npointer when trying to write to the wakeup register.\nDefine an additional struct iio_chan_spec array whose members have a NULL\nevent_spec field, and use this array instead of st_lsm6dsx_acc_channels for\nsensors without event detection capability."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:56:33.537Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7673167fac9323110973a3300637adba7d45de3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d60ffcdedfe2cdb68a1cde19bb292bc67451629"
        },
        {
          "url": "https://git.kernel.org/stable/c/81ed6e42d6e555dd978c9dd5e3f7c20cb121221b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3"
        }
      ],
      "title": "iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71198",
    "datePublished": "2026-02-04T16:07:33.154Z",
    "dateReserved": "2026-01-31T11:36:51.192Z",
    "dateUpdated": "2026-05-11T21:56:33.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71198",
      "date": "2026-09-18",
      "epss": "0.00174",
      "percentile": "0.07215"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7673167fac9323110973a3300637adba7d45de3a",
                    "status": "affected",
                    "version": "b5969abfa8b8ed43ebd93479d394f664bd4a5a87",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4d60ffcdedfe2cdb68a1cde19bb292bc67451629",
                    "status": "affected",
                    "version": "b5969abfa8b8ed43ebd93479d394f664bd4a5a87",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "81ed6e42d6e555dd978c9dd5e3f7c20cb121221b",
                    "status": "affected",
                    "version": "b5969abfa8b8ed43ebd93479d394f664bd4a5a87",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3",
                    "status": "affected",
                    "version": "b5969abfa8b8ed43ebd93479d394f664bd4a5a87",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.122",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.68",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection\n\nThe st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL\nevent_spec field, indicating support for IIO events. However, event\ndetection is not supported for all sensors, and if userspace tries to\nconfigure accelerometer wakeup events on a sensor device that does not\nsupport them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL\npointer when trying to write to the wakeup register.\nDefine an additional struct iio_chan_spec array whose members have a NULL\nevent_spec field, and use this array instead of st_lsm6dsx_acc_channels for\nsensors without event detection capability."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niio: imu: st_lsm6dsx: corregir iio_chan_spec para sensores sin detecci\u00f3n de eventos\n\nEl array st_lsm6dsx_acc_channels de la estructura iio_chan_spec tiene un campo event_spec no nulo, indicando soporte para eventos IIO. Sin embargo, la detecci\u00f3n de eventos no es compatible con todos los sensores, y si el espacio de usuario intenta configurar eventos de activaci\u00f3n del aceler\u00f3metro en un dispositivo sensor que no los soporta (p. ej., LSM6DS0), st_lsm6dsx_write_event() desreferencia un puntero NULL al intentar escribir en el registro de activaci\u00f3n.\nDefinir un array adicional de la estructura iio_chan_spec cuyos miembros tienen un campo event_spec NULL, y usar este array en lugar de st_lsm6dsx_acc_channels para sensores sin capacidad de detecci\u00f3n de eventos."
          }
        ],
        "id": "CVE-2025-71198",
        "lastModified": "2026-06-17T10:03:52.233",
        "metrics": {},
        "published": "2026-02-04T17:16:11.743",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4d60ffcdedfe2cdb68a1cde19bb292bc67451629"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7673167fac9323110973a3300637adba7d45de3a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/81ed6e42d6e555dd978c9dd5e3f7c20cb121221b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:27:38+00:00",
      "cve": "CVE-2025-71198",
      "id": "CVE-2025-71198",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71198.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:40:30Z",
      "cve": "CVE-2025-71198",
      "id": "CVE-2025-71198",
      "initial_release_date": "2026-02-05T00:27:32Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "367",
      "product_status:recommended": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71198",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71198.json",
      "version": "29"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.