The Linux kernel driver for the SPS30 chemical sensor incorrectly calculates the size of the measurement buffer in sps30_i2c_read_meas(). It uses sizeof(num), which gives the size of a 64‑bit integer (8 bytes) instead of the intended 32‑bit sensor data type. This mismatch allows the buffer to be overrun, corrupting kernel memory and causing a system crash.

The vulnerability exists in all Linux kernel releases that include the older iio:chemical: sps30_i2c driver code before the fixed commit. No specific version range is listed, so any kernel build containing the unpatched driver is at risk.

Based on the description, it is inferred that exploitation requires an attacker to have access to the I2C bus that reads from the sensor, such as a local or physically proximate attacker who can send malformed data to the driver. The CVSS score of 7.8 indicates a high severity, while the EPSS score of < 1% suggests a low probability of exploitation. Although it is not listed in the CISA KEV catalog, the presence of a buffer overflow that corrupts kernel memory remains a serious risk, and the limited attack surface means kernel integrity could still be compromised if the overflow is triggered.