CVE-2025-40114: iio: light: Add check for array bounds in veml6075_read_int_time_ms
In the Linux kernel, the following vulnerability has been resolved:
iio: light: Add check for array bounds in veml6075readinttimems
The array contains only 5 elements, but the index calculated by veml6075readinttimeindex can range from 0 to 7, which could lead to out-of-bounds access. The check prevents this issue.
Coverity Issue CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN) overrun-local: Overrunning array veml6075itms of 5 4-byte elements at element index 7 (byte offset 31) using index intindex (which evaluates to 7)
This is hardening against potentially broken hardware. Good to have but not necessary to backport.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40114?
CVE-2025-40114 has a medium severity level due to potential out-of-bounds access in the Linux kernel.
How do I fix CVE-2025-40114?
To fix CVE-2025-40114, update to the latest version of the Linux kernel where the vulnerability has been addressed.
What systems are affected by CVE-2025-40114?
CVE-2025-40114 affects the Linux kernel, specifically regarding the veml6075 light sensor driver.
What are the potential impacts of CVE-2025-40114?
The potential impacts of CVE-2025-40114 include unexpected behavior or crashes due to out-of-bounds reading.
Is there a workaround for CVE-2025-40114?
Currently, there are no known workarounds for CVE-2025-40114 other than applying the recommended updates.