LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71198: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection

In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, indicating support for IIO events. However, event detection is not supported for all sensors, and if userspace tries to configure accelerometer wakeup events on a sensor device that does not support them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL pointer when trying to write to the wakeup register. Define an additional struct iio_chan_spec array whose members have a NULL event_spec field, and use this array instead of st_lsm6dsx_acc_channels for sensors without event detection capability.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver bug affecting some ST LSM6DSx inertial sensors. If a system has a sensor that lacks event detection, userspace can request an unsupported accelerometer wakeup event and trigger a NULL pointer dereference. The likely business impact is device instability or denial of service on exposed systems with the affected hardware and driver.

Executive priority

Handle through normal kernel patch management unless affected embedded, mobile, kiosk, or edge devices expose local userspace access. Escalate if the affected sensor driver is present on business-critical devices where crashes affect safety, uptime, or field operations.

Technical view

The st_lsm6dsx IIO IMU driver advertised event support through st_lsm6dsx_acc_channels even for sensors without event detection. st_lsm6dsx_write_event() could then dereference a NULL wakeup register pointer when configuring events, such as on LSM6DS0. The fix adds a separate channel specification without event_spec for unsupported sensors.

Likely exposure

Exposure appears limited to Linux systems using the st_lsm6dsx driver with sensors that do not support event detection. The source names LSM6DS0 as an example. Practical exposure depends on hardware presence, kernel version, and userspace access to the relevant IIO device interfaces.

Exploitation context

The provided sources do not report active exploitation, public exploit availability, or KEV listing. The trigger is described as a userspace configuration request against an unsupported accelerometer wakeup event. Treat this primarily as a local stability issue unless vendor guidance says otherwise.

Researcher notes

The record provides fix rationale but no CVSS, CWE, exploit evidence, or detailed affected-version matrix beyond Linux version and commit references. The key issue is capability mismatch: event_spec is present for sensors whose wakeup register path is unavailable.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Check distribution or device-vendor advisories for packaged kernel availability.
  • Prioritize systems with ST LSM6DSx-compatible IMU hardware exposed to userspace.
  • Limit untrusted local access to affected IIO device interfaces where feasible.

Validation and detection

  • Identify kernels using the st_lsm6dsx IIO IMU driver.
  • Inventory systems with LSM6DSx-family sensors, especially LSM6DS0.
  • Confirm whether the running kernel includes one of the referenced stable fixes.
  • Review logs for kernel NULL pointer dereference reports involving st_lsm6dsx_write_event.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71198 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb5969abfa8b8ed43ebd93479d394f664bd4a5a87, b5969abfa8b8ed43ebd93479d394f664bd4a5a87, b5969abfa8b8ed43ebd93479d394f664bd4a5a87, b5969abfa8b8ed43ebd93479d394f664bd4a5a87unaffected
LinuxLinux5.5, 0, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.