The Linux kernel driver for the SPS30 chemical sensor incorrectly calculates the size of the measurement buffer in sps30_i2c_read_meas(). It uses sizeof(num), which gives the size of a 64‑bit integer (8 bytes) instead of the intended 32‑bit sensor data type. This mismatch allows the buffer to be overrun, corrupting kernel memory and potentially causing a system crash.

The vulnerability exists in all Linux kernel builds that contain the unpatched iio:chemical: sps30_i2c driver code. Any kernel version that includes the older driver before the fixed commit is at risk. Version details are not specified, so any system running a kernel with the unpatched driver should be considered vulnerable.

Based on the description, it is inferred that exploitation requires an attacker to have access to the I2C bus that communicates with the sensor. This could be a local or physically proximate attacker who can send malformed data to trigger the overflow. The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation. It is not listed in the CISA KEV catalog, but the presence of a buffer overflow that corrupts kernel memory remains a serious risk, especially if the attacker can manipulate the sensor data.