CVE-2025-40114: iio: light: Add check for array bounds in veml6075_read_int_time_ms
First published: Fri Apr 18 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: iio: light: Add check for array bounds in veml6075_read_int_time_ms The array contains only 5 elements, but the index calculated by veml6075_read_int_time_index can range from 0 to 7, which could lead to out-of-bounds access. The check prevents this issue. Coverity Issue CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN) overrun-local: Overrunning array veml6075_it_ms of 5 4-byte elements at element index 7 (byte offset 31) using index int_index (which evaluates to 7) This is hardening against potentially broken hardware. Good to have but not necessary to backport.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-40114?
CVE-2025-40114 has a medium severity level due to potential out-of-bounds access in the Linux kernel.
How do I fix CVE-2025-40114?
To fix CVE-2025-40114, update to the latest version of the Linux kernel where the vulnerability has been addressed.
What systems are affected by CVE-2025-40114?
CVE-2025-40114 affects the Linux kernel, specifically regarding the veml6075 light sensor driver.
What are the potential impacts of CVE-2025-40114?
The potential impacts of CVE-2025-40114 include unexpected behavior or crashes due to out-of-bounds reading.
Is there a workaround for CVE-2025-40114?
Currently, there are no known workarounds for CVE-2025-40114 other than applying the recommended updates.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/linux
- canonical/linux kernel