{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "116d1f8805ae2daadbac89d24da4c0da50b9edae",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "94d158985b6ea011bdc26186f42d662a156da6cb",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "1d24f14e049fdd769146dda026496ed23b397ed9",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "9ac3675bf875792dced45efbf47116719a7c097b",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "3c374d33f1338dbb5676919c5194caa9c5aa1631",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            },
            {
              "lessThan": "947eb6f0a274f8b15a0248051a65b069effd5057",
              "status": "affected",
              "version": "d5c70627a79455154f5f636096abe6fe57510605",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/xilinx-ams.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling\n\nams_event_to_channel() may return a pointer past the end of\ndev-\u003echannels when no matching scan_index is found. This can lead\nto invalid memory access in ams_handle_event().\n\nAdd a bounds check in ams_event_to_channel() and return NULL when\nno channel is found. Also guard the caller to safely handle this\ncase."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the Xilinx ZynqMP AMS IIO platform driver and is reached from a hardware AMS alarm IRQ after local IIO sysfs or /dev/iio:device* threshold-event configuration; it is not exposed through any network-facing kernel service.\nAC:L - A local actor with IIO event write access can enable AMS threshold alarms, program thresholds, and repeatedly trigger the interrupt path; on common ZynqMP boards with partial PL channel tables, SYSMON can assert alarm status bits that lack a matching dev-\u003echannels entry when the ISR is handled.\nPR:L - Exploitation requires local access to configure or interact with the xilinx-ams IIO device (sysfs event enable/threshold writes or an open event character device); it does not require init-namespace root, only a local account with device access typical on embedded ZynqMP monitoring stacks.\nUI:N - After AMS threshold monitoring is enabled (commonly at boot on industrial, automotive, and aerospace ZynqMP systems), the vulnerable code runs automatically on hardware alarm interrupts without any additional victim action at exploitation time.\nS:U - Impact is confined to kernel memory safety and IIO event handling within the same host OS security boundary; this is not a VM escape, hypervisor bypass, or cross-tenant boundary crossing.\nC:H - ams_event_to_channel() returns a pointer one element past dev-\u003echannels, and ams_handle_event() performs out-of-bounds reads of struct iio_chan_spec fields that are fed into iio_push_event(), enabling disclosure of adjacent kernel memory to userspace event readers.\nI:H - The out-of-bounds iio_chan_spec dereference reads attacker-influenced adjacent kernel memory used to drive iio_push_event() control flow and event metadata, which is a memory-safety violation with potential for further kernel compromise beyond simple denial of service.\nA:H - Processing an alarm index with no matching channel causes invalid kernel memory access in interrupt context, which can produce a kernel oops or panic and deny service on safety-critical embedded controllers relying on AMS monitoring."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:43.931Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae"
        },
        {
          "url": "https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631"
        },
        {
          "url": "https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057"
        }
      ],
      "title": "iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72480",
    "datePublished": "2026-08-15T05:57:18.975Z",
    "dateReserved": "2026-08-09T03:40:39.935Z",
    "dateUpdated": "2026-08-17T05:44:43.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}