Strix
26.1K

CVE-2026-64497

Unknown

Last modified

CVE-2026-64497 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD_GET(). Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELD_GET(). The current variable declaration and initializations are barely readable and use comma separations across multiple lines. Refactor the initializations so that mantissa and exp have separate declarations and sign gets initialized later. In addition (and due to the nature of the cleanup), fix a sign-extension bug where, float32 would get bitwise anded with ~BIT(31) (which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent..

Description

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD_GET(). Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELD_GET(). The current variable declaration and initializations are barely readable and use comma separations across multiple lines. Refactor the initializations so that mantissa and exp have separate declarations and sign gets initialized later. In addition (and due to the nature of the cleanup), fix a sign-extension bug where, float32 would get bitwise anded with ~BIT(31) (which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 64b3d8b1b0f5c16c19045785e4da8391ae35ec99, < 0ccff849bde90973e6c13a666f6ceab5c55b30d4; >= 64b3d8b1b0f5c16c19045785e4da8391ae35ec99, < 1821bcacd8ac5b214c53be16cbb8172bf193f0b6; >= 64b3d8b1b0f5c16c19045785e4da8391ae35ec99, < 40bb0fdb37f441c9c9f52bf58bbd8a0ca3cc9598; >= 64b3d8b1b0f5c16c19045785e4da8391ae35ec99, < b131f0011dfef72350f4e3f11df94dc3e6b46065; >= 64b3d8b1b0f5c16c19045785e4da8391ae35ec99, < 8d4a46e971cf846bda98b20d4cabfa21c1276e5f; >= 64b3d8b1b0f5c16c19045785e4da8391ae35ec99, < 82accdd57404399eddf3d56fd9beda7c61307388; >= 64b3d8b1b0f5c16c19045785e4da8391ae35ec99, < d49ff54b2784aa56a7c97982de713604de89d23a; >= 64b3d8b1b0f5c16c19045785e4da8391ae35ec99, < 60d877910a43c305b5165131b258a17b1d772d57
LinuxLinux5.9

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-64497?
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD_GET(). Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELD_GET(). The current variable declaration and initializations are barely readable and use comma separations across multiple lines. Refactor the initializations so that mantissa and exp have separate declarations and sign gets initialized later. In addition (and due to the nature of the cleanup), fix a sign-extension bug where, float32 would get bitwise anded with ~BIT(31) (which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.
How severe is CVE-2026-64497?
Severity scoring for CVE-2026-64497 is pending analysis.
How do I fix CVE-2026-64497?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-64497?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST