The Linux kernel sensorhub driver fails to validate the sensor number provided by EC FIFO events before indexing an array, allowing an out‑of‑bounds read/write of the batch_state array. The memory corruption could compromise kernel integrity, potentially enabling privilege The flaw lies in the ring handler that processes sensor events, which runs at kernel privilege.

The vulnerability affects the Linux kernel’s sensorhub component on all kernel releases that include the sensorhub driver without the sensor‑number validation patch. No specific version information is provided in the CVE description.

This is a classic out‑of‑bounds error (CWE‑787). The EPSS score indicates a 0.002 probability of exploitation, which translates to less than 1% but is not zero. The vulnerability is not listed in the CISA KEV catalog. While the severity is moderate because it occurs in kernel mode, exploiting it requires local or remote access that allows influencing the EC firmware to generate malformed sensor numbers.