CVE-2026-63932 Details
Description
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19b_receive_buf() appends each serdev chunk into the fixed MHZ19B_CMD_SIZE receive buffer and advances buf_idx by len without checking that the chunk fits in the remaining space. A large callback can therefore overflow st->buf before the command path validates the reply. Reset the reply state before each command and reject oversized serial replies before copying them into the fixed buffer. When an oversized reply is detected, wake the waiter and report -EMSGSIZE instead of overwriting st->buf.
A vulnerability in the Linux kernel's handling of serial replies from the MH-Z19B CO2 sensor has been addressed. The issue arose because the 'mhz19b_receive_buf()' function did not properly check if incoming data chunks fit within the designated buffer, leading to potential buffer overflows. This flaw could allow oversized replies to overwrite important state information before the command processing could validate the response. The vulnerability has been fixed by adding checks to reject oversized replies and by resetting the reply state before each command, ensuring that the buffer is not improperly overwritten.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 19, 2026 | New CVE Received | kernel.org |