Description
In the Linux kernel, the following vulnerability has been resolved:
iio: accel: bmc150: Fix irq assumption regression
The code in bmc150-accel-core.c unconditionally calls
bmc150_accel_set_interrupt() in the iio_buffer_setup_ops,
such as on the runtime PM resume path giving a kernel
splat like this if the device has no interrupts:
Unable to handle kernel NULL pointer dereference at virtual
address 00000001 when read
PC is at bmc150_accel_set_interrupt+0x98/0x194
LR is at __pm_runtime_resume+0x5c/0x64
(...)
Call trace:
bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108
bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc
__iio_update_buffers from enable_store+0x84/0xc8
enable_store from kernfs_fop_write_iter+0x154/0x1b4
This bug seems to have been in the driver since the beginning,
but it only manifests recently, I do not know why.
Store the IRQ number in the state struct, as this is a common
pattern in other drivers, then use this to determine if we have
IRQ support or not.
iio: accel: bmc150: Fix irq assumption regression
The code in bmc150-accel-core.c unconditionally calls
bmc150_accel_set_interrupt() in the iio_buffer_setup_ops,
such as on the runtime PM resume path giving a kernel
splat like this if the device has no interrupts:
Unable to handle kernel NULL pointer dereference at virtual
address 00000001 when read
PC is at bmc150_accel_set_interrupt+0x98/0x194
LR is at __pm_runtime_resume+0x5c/0x64
(...)
Call trace:
bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108
bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc
__iio_update_buffers from enable_store+0x84/0xc8
enable_store from kernfs_fop_write_iter+0x154/0x1b4
This bug seems to have been in the driver since the beginning,
but it only manifests recently, I do not know why.
Store the IRQ number in the state struct, as this is a common
pattern in other drivers, then use this to determine if we have
IRQ support or not.
Published:
2025-12-22
Score:
n/a
EPSS:
< 1% Very Low
KEV:
No
Impact:
n/a
Action:
n/a
Analysis and contextual insights are available on OpenCVE Cloud.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4436-1 | linux-6.1 security update |
Ubuntu USN |
USN-8094-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8095-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8096-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8095-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-8096-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-8100-1 | Linux kernel (NVIDIA) vulnerabilities |
Ubuntu USN |
USN-8094-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8095-3 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-8096-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8096-4 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-8095-4 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-8096-5 | Linux kernel (NVIDIA Tegra IGX) vulnerabilities |
Ubuntu USN |
USN-8116-1 | Linux kernel (Intel IoTG Real-time) vulnerabilities |
Ubuntu USN |
USN-8094-3 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-8094-4 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8125-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8126-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8094-5 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-8095-5 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-8141-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-8152-1 | Linux kernel (OEM) vulnerabilities |
Ubuntu USN |
USN-8163-1 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-8165-1 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-8163-2 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8243-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8261-1 | Linux kernel (Xilinx) vulnerabilities |
References
History
Tue, 23 Dec 2025 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 22 Dec 2025 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: Fix irq assumption regression The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts: Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read PC is at bmc150_accel_set_interrupt+0x98/0x194 LR is at __pm_runtime_resume+0x5c/0x64 (...) Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4 This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why. Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not. | |
| Title | iio: accel: bmc150: Fix irq assumption regression | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-05-11T21:51:06.153Z
Reserved: 2025-12-16T14:48:05.296Z
Link: CVE-2025-68330
No data.
Status : Deferred
Published: 2025-12-22T17:16:00.680
Modified: 2026-04-15T00:35:42.020
Link: CVE-2025-68330
OpenCVE Enrichment
No data.
Weaknesses
No weakness.
Debian DLA
Ubuntu USN