CVE-2026-64497
In the Linux kernel, the following vulnerability has been resolved:
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
Include linux/bitfield.h for FIELD_GET().
Create new macros for bit manipulation in combination with manual bit
manipulation being replaced with FIELD_GET().
The current variable declaration and initializations are barely readable
and use comma separations across multiple lines. Refactor the
initializations so that mantissa and exp have separate declarations and
sign gets initialized later.
In addition (and due to the nature of the cleanup), fix a sign-extension
bug where, float32 would get bitwise anded with ~BIT(31)
(which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.
CSIRTS triage
- What
- This vulnerability involves cleanup initializations and a sign-extension bug in the scd30 driver.
- Who is affected
- Deployments using the iio chemical subsystem.
- Urgency
- Remediation is necessary to ensure correct functionality, with no current exploitation reported.
- Action
- Apply the cleanup and fix for the sign-extension bug in the scd30 driver.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-64497
Get an email if CVE-2026-64497 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-64497)