The Linux IIO driver for the Texas Instruments ADS1298 analog‑to‑digital converter contains an array bounds error. The pga_settings array holds seven entries, but the ADS1298_MASK_CH_PGA register can return values from 0 to 7. When a value of 7 is supplied, the driver accesses the array out of bounds, causing an uncontrolled memory write can corrupt kernel memory, potentially enabling local privilege escalation or a system crash. The vulnerability is classified as CWE‑787.

All Linux kernel releases that include the ti-ads1298 driver before the patch commit. The affected kernel code is part of the "iio: adc" subsystem. No specific kernel version list is provided, so any kernel that has not applied the bounds check should be considered vulnerable.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% indicates an extremely low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the developer code only triggers the out‑of‑bounds access when the device reports a PGA value of 7, a condition that would normally be reserved register selection or inject commands into the device, which suggests a local attack scenario. However, because the driver runs in kernel space, a local exploit could result in privilege escalation to root or a system crash.