The vulnerability arises from an out-of-bounds array index in the BMP280 pressure sensor driver. The sampling frequency lookup table is stored in a flat array, but the write function treats it as two-dimensional and uses an incorrect row count, enabling a read outside the bounds of the array. This flaw can expose arbitrary kernel memory or trigger a crash, leading to information disclosure or a denial-of-service condition.

The issue appears in all Linux kernel releases that contain the unpatched bmp280 driver code. No specific kernel version range is supplied, so any deployment running a kernel built before the commit that introduced the fix is potentially vulnerable. Supports any architecture that includes the BMP280 iio driver.

The flaw requires local access to the BMP280 device interface—typically through sysfs entries exposed by the kernel's industrial I/O subsystem. An attacker with such access can set a sampling frequency value that triggers the out-of-bounds read, potentially reading sensitive memory or causing a kernel panic. While the CVSS score is not listed, the exploit probability is uncertain (EPSS not available) and the vulnerability is not currently in the CISA KEV list. Nevertheless, the possibility of denial-of-service or information disclosure warrants timely patching.