CVE-2026-63932

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: chemical: mhz19b: reject oversized serial replies<br /> <br /> mhz19b_receive_buf() appends each serdev chunk into the fixed<br /> MHZ19B_CMD_SIZE receive buffer and advances buf_idx by len without<br /> checking that the chunk fits in the remaining space. A large callback<br /> can therefore overflow st-&gt;buf before the command path validates the<br /> reply.<br /> <br /> Reset the reply state before each command and reject oversized serial<br /> replies before copying them into the fixed buffer. When an oversized<br /> reply is detected, wake the waiter and report -EMSGSIZE instead of<br /> overwriting st-&gt;buf.