An out-of-bounds read fault exists in the Linux kernel BMP280 driver. The driver stores sampling‑frequency values in a flattened array but walks the table as a two‑dimensional array, using an incorrect number of rows. This discrepancy allows reads beyond the end of the array, potentially exposing kernel memory or causing a crash that leads to a denial of service.

Any Linux kernel that includes the BMP280 IIO driver code before the commit that introduced the fix is affected. The vulnerability applies to all architectures that compile the BMP280 driver as part of the kernel’s industrial I/O subsystem. No specific kernel version range is listed, so any deployment running a kernel built prior to the fix is potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the bug can be triggered locally by writing a sampling‑frequency value through the BMP280 driver interface exposed via sysfs, potentially allowing an attacker with file‑system write access to cause an information‑disclosure or crash condition.