The Linux kernel’s VEML6075 IIO light driver contains an array with only five elements, but an external register can provide a value up to seven. If the driver reads a value of five or greater, it accesses the array out of bounds, which can corrupt kernel memory. The patch adds a bounds check that returns an error when the index is out of range, preventing the memory corruption. The defect is a classic buffer overrun (CWE‑787).

All Linux kernel releases that include the VEML6075 driver prior to the patch are affected. This includes upstream kernels that have not been backported by a distribution. The flaw is confined to the IIO light subsystem and does not affect other kernel components.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. The likely attack vector is a local or bus-level attacker who can inject an out-of-range VEML6075_CONF_IT value, for example through a fault device or misconfigured firmware. Because the corruption occurs in kernel space, it could lead to a kernel crash or unpredictable behavior. No direct evidence of privilege escalation is provided in the description.