When a user writes a buffer sampling frequency to the st_lsm6dsx driver via a sysfs attribute, the driver checks the desired rate by accessing an array indexed by the sensor’s identifier. The array only contains two entries for the accelerometer and gyroscope, so any attempt to set the frequency for a different sensor type indexes outside the array bounds, exposing kernel memory contents. This out‑of‑bounds read can potentially disclose confidential data and, depending on how the memory is interpreted, could destabilize the kernel. The flaw resides in the st_lsm6dsx driver module of the Linux kernel.

All Linux kernel builds that include the st_lsm6dsx driver before the patch, including the 7.0 release candidates (rc1 through rc6) and other earlier versions that compile the driver. Systems using the default kernel configuration with the driver enabled are affected.

The CVSS score of 7.8 indicates a moderate‑to‑high severity. The EPSS score of less than 1% shows a very low exploitation probability at the time of this report. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to have root or elevated privileges capable of writing to the sysfs attribute, making it a local privilege‑escalation scenario rather than a remote attack.