CVE-2026-53387: iio: light: veml6075: add bounds check to veml6075_it_ms index
In the Linux kernel, the following vulnerability has been resolved:
iio: light: veml6075: add bounds check to veml6075itms index
veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value >= 5, this causes an out-of-bounds array access. Add a bounds check and return -EINVAL if the index is out of range.
The problem values are reserved so should never be read from the register. Hence this is hardening against fault device, missprogramming or bus corruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In veml6075_it_ms, add a bounds check for the index derived from VEML6075_CONF_IT. If the computed index is out of range (veml6075_it_ms has 5 elements, and VEML6075_CONF_IT can yield 0-7), return -EINVAL instead of accessing veml6075_it_ms out of bounds (values >= 5).
Linux kernel iio: light: veml6075 veml6075_it_ms index = Add bounds check and return -EINVAL when index is out of range
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53387?
CVE-2026-53387 has a high severity rating of 7.1 according to the CVSS scoring.
How do I fix CVE-2026-53387?
To fix CVE-2026-53387, ensure that your Linux kernel is updated to a version that includes the bounds check patch.
What impact does CVE-2026-53387 have on systems?
CVE-2026-53387 can lead to out-of-bounds array access which may result in a crash or undefined behavior in the Linux kernel.
In which software is CVE-2026-53387 found?
CVE-2026-53387 is found in the Linux kernel, specifically affecting the iio: light: veml6075 module.
What type of vulnerability is CVE-2026-53387 categorized as?
CVE-2026-53387 is categorized as an out-of-bounds read vulnerability.