CVE-2026-43476: iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
In the Linux kernel, the following vulnerability has been resolved:
iio: chemical: sps30i2c: fix buffer size in sps30i2creadmeas()
sizeof(num) evaluates to sizeof(sizet) (8 bytes on 64-bit) instead of the intended be32 element size (4 bytes). Use sizeof(meas) to correctly match the buffer element type.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43476?
CVE-2026-43476 has a medium severity level due to potential buffer size vulnerabilities in the Linux kernel.
How do I fix CVE-2026-43476?
To fix CVE-2026-43476, update the Linux kernel to the latest patched version that addresses the buffer size issues in sps30_i2c_read_meas().
What impacts does CVE-2026-43476 have on systems?
CVE-2026-43476 can lead to unexpected behavior or data corruption due to incorrect buffer sizing in the affected component.
Which versions of the Linux kernel are affected by CVE-2026-43476?
CVE-2026-43476 affects various versions of the Linux kernel prior to the implementation of the patch that resolves the buffer size issue.
Is CVE-2026-43476 actively exploited in the wild?
As of now, there are no confirmed reports of CVE-2026-43476 being actively exploited in the wild.