CVE-2026-53387 iio: light: veml6075: add bounds check to veml6075_it_ms index
A missing bounds check in the VEML6075 light sensor driver allows out-of-bounds array access, potentially causing a kernel crash or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53387?
CVE-2026-53387 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: light: veml6075: add bounds check to veml6075_it_ms index
veml6075_it_ms has 5 elements but VEML6075_CONF_IT can yield values 0-7. If it returns a value >= 5, this causes an out-of-bounds array access. Add a bounds check and return -EINVAL if the index is out of range.
The problem values are reserved so should never be read from the register. Hence this is hardening against fault device, missprogramming or bus corruption.
Weakness: CWE-129
Which versions are affected by CVE-2026-53387?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53387?
Apply the vendor's patch.
Is CVE-2026-53387 being exploited?
There is no known exploitation of CVE-2026-53387 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53387, DEBIAN-CVE-2026-53387, GHSA-83px-8fr4-3c85, ROOT-OS-UBUNTU-2204-CVE-2026-53387, UBUNTU-CVE-2026-53387.