The flaw resides in the bmg160 gyro driver of the Linux kernel. When an unsupported bandwidth or filter value is requested, the driver walks a static frequency table and, upon not finding a matching entry, reads past the end of the array to obtain a filter value. This produces an out‑of‑bounds read (CWE‑125). The kernel returns a negative status after the read, so the error is not immediately obvious to a caller, but the read can disclose kernel memory contents.

All Linux kernel distributions that ship the bmg160 driver without the upstream patch are vulnerable. The driver is part of the standard drivers/iio/gyro/bmg160_core.c source tree, so any kernel that has not applied the fix on the current subsystem is susceptible.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog. The only public control path that can trigger the out‑of‑bounds read is the sysfs attribute in_anglvel_filter_low_pass_3db_frequency. Any local user with write permission to that file can supply an unsupported frequency value, causing the kernel to read past the array. While no exploit is publicly available, a determined local attacker could leverage the memory disclosure or induce a kernel panic, potentially enabling privilege escalation or denial‑of‑service. The CVE belongs to CWE‑125, an out‑of‑bounds read, which makes it a classic memory corruption issue that could be leveraged in a local context. Given the low probability of automated exploitation but the high impact of an ongoing kernel exposure, applying a patch or otherwise blocking write access is recommended.