Sensor-read hang via unchecked integration-time index
Published Jul 19, 2026 · Updated Jul 19, 2026
Out-of-bounds read in the Linux Kernel VEML6075 IIO driver allows local users to interrupt sensor reads through local sysfs access. The read path extracts the three-bit VEML6075_CONF_IT value and uses it without validation to index the five-entry veml6075_it_ms table, then passes the out-of-bounds value to msleep(). Triggering requires an invalid reserved register value from a faulty or misprogrammed device, bus corruption, or local I2C access; the resulting long sleep blocks sensor reads without modifying memory or executing code.
Summary
What happened
Out-of-bounds read in the Linux Kernel VEML6075 IIO driver allows local users to interrupt sensor reads through local sysfs access. The read path extracts the three-bit VEML6075_CONF_IT value and uses it without validation to index the five-entry veml6075_it_ms table, then passes the out-of-bounds value to msleep(). Triggering requires an invalid reserved register value from a faulty or misprogrammed device, bus corruption, or local I2C access; the resulting long sleep blocks sensor reads without modifying memory or executing code.
The record
- CVE
- CVE-2026-53387
- Published
- Jul 19, 2026
- Updated
- Jul 19, 2026
- Vendor
- The Linux Kernel Organization
- Product
- Linux Kernel
- Classifications
- CWE-129, T1499
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- Jul 19, 2026CVE publishedPublication date reported by the CVE source.
- Jul 19, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=0 <6.12.95
- Affected versionversion=0 <6.18.37
- Affected versionversion=0 <7.0.14
- Affected versionversion=0 <7.1.2
- Affected versionversion=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0a89002737ee34decc20fa232204dbe5fe83e0de
- Affected versionversion=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <307dc4240bd41852d9e0912921e298160db1c109
- Affected versionversion=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <df9127a1d2d748e426c49c8fcd9b6801e4eb743d
- Affected versionversion=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e545936e06f1c7173ab41a5f33a77ff43ced3a8d
- Affected versionversion=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f75beebcd5bc9bdc80e0722142e78a6f306214ee
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo