Skip to content
Heist/ feed
UnratedFix available

iio: chemical: scd30: Cleanup initializations and fix sign-extension bug

Type: advisorySource: OSV1 source record

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD_GET(). Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELD_GET(). The current variable declaration and initializations are barely readable and use comma separations across multiple lines. Refactor the initializations so that mantissa and exp have separate declarations and sign gets initialized later. In addition (and due to the nature of the cleanup), fix a sign-extension bug where, float32 would get bitwise anded with ~BIT(31) (which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.

Announced Source revision 1
Original source ↗

CVE-2026-64497

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:CVE-2026-64497

Kernel

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
5.10.261

Source reference: /affected/1/ranges

5.15.212

Source reference: /affected/1/ranges

6.1.178

Source reference: /affected/1/ranges

6.6.145

Source reference: /affected/1/ranges

6.12.96

Source reference: /affected/1/ranges

6.18.39

Source reference: /affected/1/ranges

7.1.4

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
        "type": "GIT",
        "events": [
          {
            "introduced": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99"
          },
          {
            "fixed": "0ccff849bde90973e6c13a666f6ceab5c55b30d4"
          },
          {
            "fixed": "1821bcacd8ac5b214c53be16cbb8172bf193f0b6"
          },
          {
            "fixed": "40bb0fdb37f441c9c9f52bf58bbd8a0ca3cc9598"
          },
          {
            "fixed": "b131f0011dfef72350f4e3f11df94dc3e6b46065"
          },
          {
            "fixed": "8d4a46e971cf846bda98b20d4cabfa21c1276e5f"
          },
          {
            "fixed": "82accdd57404399eddf3d56fd9beda7c61307388"
          },
          {
            "fixed": "d49ff54b2784aa56a7c97982de713604de89d23a"
          },
          {
            "fixed": "60d877910a43c305b5165131b258a17b1d772d57"
          }
        ]
      }
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64497.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.9.0"
          },
          {
            "fixed": "5.10.261"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.11.0"
          },
          {
            "fixed": "5.15.212"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.16.0"
          },
          {
            "fixed": "6.1.178"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.2.0"
          },
          {
            "fixed": "6.6.145"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.7.0"
          },
          {
            "fixed": "6.12.96"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.13.0"
          },
          {
            "fixed": "6.18.39"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.19.0"
          },
          {
            "fixed": "7.1.4"
          }
        ]
      }
    ],
    "package": {
      "name": "Kernel",
      "ecosystem": "Linux"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64497.json"
    }
  }
]
Related CVEs
CVE-2026-64497

Source reference: /id

Publisher severity

No explicit severity was provided.

Event
#50710 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement