{"api_version":"1","generated_at":"2026-08-24T09:49:35+00:00","cve":"CVE-2026-72480","urls":{"html":"https://cve.report/CVE-2026-72480","api":"https://cve.report/api/cve/CVE-2026-72480.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72480","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72480"},"summary":{"title":"iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\n\nams_event_to_channel() may return a pointer past the end of\ndev->channels when no matching scan_index is found. This can lead\nto invalid memory access in ams_handle_event().\n\nAdd a bounds check in ams_event_to_channel() and return NULL when\nno channel is found. Also guard the caller to safely handle this\ncase.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:22","updated_at":"2026-08-17 06:19:16"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b","name":"https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae","name":"https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057","name":"https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9","name":"https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631","name":"https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb","name":"https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72480","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72480","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d5c70627a79455154f5f636096abe6fe57510605 116d1f8805ae2daadbac89d24da4c0da50b9edae git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d5c70627a79455154f5f636096abe6fe57510605 94d158985b6ea011bdc26186f42d662a156da6cb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d5c70627a79455154f5f636096abe6fe57510605 1d24f14e049fdd769146dda026496ed23b397ed9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d5c70627a79455154f5f636096abe6fe57510605 9ac3675bf875792dced45efbf47116719a7c097b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d5c70627a79455154f5f636096abe6fe57510605 3c374d33f1338dbb5676919c5194caa9c5aa1631 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d5c70627a79455154f5f636096abe6fe57510605 947eb6f0a274f8b15a0248051a65b069effd5057 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.178 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.145 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72480","cve":"CVE-2026-72480","epss":"0.001380000","percentile":"0.037070000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/adc/xilinx-ams.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"116d1f8805ae2daadbac89d24da4c0da50b9edae","status":"affected","version":"d5c70627a79455154f5f636096abe6fe57510605","versionType":"git"},{"lessThan":"94d158985b6ea011bdc26186f42d662a156da6cb","status":"affected","version":"d5c70627a79455154f5f636096abe6fe57510605","versionType":"git"},{"lessThan":"1d24f14e049fdd769146dda026496ed23b397ed9","status":"affected","version":"d5c70627a79455154f5f636096abe6fe57510605","versionType":"git"},{"lessThan":"9ac3675bf875792dced45efbf47116719a7c097b","status":"affected","version":"d5c70627a79455154f5f636096abe6fe57510605","versionType":"git"},{"lessThan":"3c374d33f1338dbb5676919c5194caa9c5aa1631","status":"affected","version":"d5c70627a79455154f5f636096abe6fe57510605","versionType":"git"},{"lessThan":"947eb6f0a274f8b15a0248051a65b069effd5057","status":"affected","version":"d5c70627a79455154f5f636096abe6fe57510605","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/adc/xilinx-ams.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.178","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.145","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.17","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\n\nams_event_to_channel() may return a pointer past the end of\ndev->channels when no matching scan_index is found. This can lead\nto invalid memory access in ams_handle_event().\n\nAdd a bounds check in ams_event_to_channel() and return NULL when\nno channel is found. Also guard the caller to safely handle this\ncase."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the Xilinx ZynqMP AMS IIO platform driver and is reached from a hardware AMS alarm IRQ after local IIO sysfs or /dev/iio:device* threshold-event configuration; it is not exposed through any network-facing kernel service.\nAC:L - A local actor with IIO event write access can enable AMS threshold alarms, program thresholds, and repeatedly trigger the interrupt path; on common ZynqMP boards with partial PL channel tables, SYSMON can assert alarm status bits that lack a matching dev->channels entry when the ISR is handled.\nPR:L - Exploitation requires local access to configure or interact with the xilinx-ams IIO device (sysfs event enable/threshold writes or an open event character device); it does not require init-namespace root, only a local account with device access typical on embedded ZynqMP monitoring stacks.\nUI:N - After AMS threshold monitoring is enabled (commonly at boot on industrial, automotive, and aerospace ZynqMP systems), the vulnerable code runs automatically on hardware alarm interrupts without any additional victim action at exploitation time.\nS:U - Impact is confined to kernel memory safety and IIO event handling within the same host OS security boundary; this is not a VM escape, hypervisor bypass, or cross-tenant boundary crossing.\nC:H - ams_event_to_channel() returns a pointer one element past dev->channels, and ams_handle_event() performs out-of-bounds reads of struct iio_chan_spec fields that are fed into iio_push_event(), enabling disclosure of adjacent kernel memory to userspace event readers.\nI:H - The out-of-bounds iio_chan_spec dereference reads attacker-influenced adjacent kernel memory used to drive iio_push_event() control flow and event metadata, which is a memory-safety violation with potential for further kernel compromise beyond simple denial of service.\nA:H - Processing an alarm index with no matching channel causes invalid kernel memory access in interrupt context, which can produce a kernel oops or panic and deny service on safety-critical embedded controllers relying on AMS monitoring."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:44:43.931Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae"},{"url":"https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb"},{"url":"https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9"},{"url":"https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b"},{"url":"https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631"},{"url":"https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057"}],"title":"iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72480","datePublished":"2026-08-15T05:57:18.975Z","dateReserved":"2026-08-09T03:40:39.935Z","dateUpdated":"2026-08-17T05:44:43.931Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:22","lastModifiedDate":"2026-08-17 06:19:16","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72480","Ordinal":"1","Title":"iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event ","CVE":"CVE-2026-72480","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72480","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\n\nams_event_to_channel() may return a pointer past the end of\ndev->channels when no matching scan_index is found. This can lead\nto invalid memory access in ams_handle_event().\n\nAdd a bounds check in ams_event_to_channel() and return NULL when\nno channel is found. Also guard the caller to safely handle this\ncase.","Type":"Description","Title":"iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event "}]}}}