CVE-2026-53387

Received Received - Intake

Bounds Check Bypass in Linux Kernel IIO VEML6075 Driver

Publication date: 2026-07-19

Last updated on: 2026-07-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075_it_ms index veml6075_it_ms has 5 elements but VEML6075_CONF_IT can yield values 0-7. If it returns a value >= 5, this causes an out-of-bounds array access. Add a bounds check and return -EINVAL if the index is out of range. The problem values are reserved so should never be read from the register. Hence this is hardening against fault device, missprogramming or bus corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-20

Generated

2026-07-20

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-53387

EUVD

EUVD-2026-45509

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel related to the VEML6075 light sensor driver. The issue involves an out-of-bounds array access in the veml6075_it_ms index. The array has only 5 elements, but the VEML6075_CONF_IT configuration can produce values from 0 to 7. If the value is 5 or higher, it causes an out-of-bounds read, potentially leading to memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO light sensor subsystem, particularly the veml6075 driver. Detection requires checking kernel logs for out-of-bounds access errors or examining the veml6075 driver code for improper index handling. No network-specific detection commands are applicable.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior if exploited. It may lead to denial-of-service conditions or potential privilege escalation if an attacker can manipulate the sensor configuration. Systems using the VEML6075 light sensor driver are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a low-level hardware driver issue in the Linux kernel that could lead to memory corruption if exploited, but there is no evidence it impacts data privacy or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. If immediate patching is not possible, disable the veml6075 driver module if not in use. Monitor kernel logs for any related errors indicating potential exploitation attempts.

Hi! I’m here to help you understand CVE-2026-53387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70