In the Linux kernel, the following vulnerability has been resolved:
iio: accel: bmc150: Fix irq assumption regression
The code in bmc150-accel-core.c unconditionally calls bmc150accelsetinterrupt() in the iiobuffersetupops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts:
Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read
PC is at bmc150accelsetinterrupt+0x98/0x194 LR is at _pmruntimeresume+0x5c/0x64 (...) Call trace: bmc150accelsetinterrupt from bmc150accelbufferpostenable+0x40/0x108 bmc150accelbufferpostenable from _iioupdatebuffers+0xbe0/0xcbc _iioupdatebuffers from enablestore+0x84/0xc8 enablestore from kernfsfopwriteiter+0x154/0x1b4
This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why.
Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68330.json",
"cna_assigner": "Linux"
}