Log in Start free

Vulnerability · Published Jul 19, 2026 · Assigned by Linux

CVE-2026-63932iio: chemical: mhz19b: reject oversized serial replies

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 95.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19b_receive_buf() appends each serdev chunk into the fixed MHZ19B_CMD_SIZE receive buffer and advances buf_idx by len without checking that the chunk fits in the remaining space. A large callback can therefore overflow st->buf before the command path validates the reply. Reset the reply state before each command and reject oversized serial replies before copying them into the fixed buffer. When an oversized reply is detected, wake the waiter and report -EMSGSIZE instead of overwriting st->buf.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14linux7.0.12-1DEBIAN-CVE-2026-63932
Ubuntu:26.04:LTSlinux7.0.0-28.28UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-aws7.0.0-1009.9UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-azure7.0.0-1010.10UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-azure-7.07.0.0-1014.14~24.04.1UBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-azure-fde7.0.0-1009.9UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-azure-fde-7.07.0.0-1013.13~24.04.1UBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-gcp7.0.0-1008.8UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-gcp-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-gke7.0.0-1003.4UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-28.28~24.04.1UBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-ibm7.0.0-1010.10UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1016.16UBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-nvidia-7.07.0.0-1016.16~24.04.1UBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-nvidia-bos7.0.0-2016.16UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1009.9UBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-oracle7.0.0-1008.8UBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-oracle-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-raspi7.0.0-1015.15UBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-realtime7.0.0-28.28.1UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-63932
Ubuntu:26.04:LTSlinux-riscv7.0.0-28.28.1UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-63932
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-28.28.1~24.04.3UBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-63932
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-63932

Affected products (as reported)

VendorProductVersions
Linux Linux 4572a70b3681e38055c78d12fb68cd147bdbee7d – before a5a05410cb34bfa486d63684cdc1f87a3b13f20a4572a70b3681e38055c78d12fb68cd147bdbee7d – before ea69e7a6efa88ef32090a91064c362738cc19ddd4572a70b3681e38055c78d12fb68cd147bdbee7d – before 673478bc29cf72010faaf293c1c8c667393335a0
Linux Linux 6.16

References