CVE-2026-53387 Overview
CVE-2026-53387 is an out-of-bounds read vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem. The flaw resides in the veml6075 ultraviolet light sensor driver. The veml6075_it_ms lookup array contains only 5 elements, while the VEML6075_CONF_IT register field can produce index values from 0 to 7. When the driver reads an unexpected value from the device, it accesses memory beyond the array bounds. The upstream fix adds a bounds check and returns -EINVAL when the index exceeds the valid range.
Critical Impact
A local attacker with driver access, a malfunctioning sensor, or bus corruption can trigger an out-of-bounds read leading to information disclosure or kernel instability.
Affected Products
- Linux kernel builds including the iio/light/veml6075 driver
- Systems using the Vishay VEML6075 UV light sensor over I2C
- Distributions shipping affected stable kernel branches prior to the fix commits
Discovery Timeline
- 2026-07-19 - CVE-2026-53387 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-53387
Vulnerability Analysis
The veml6075 driver exposes UV sensor readings through the Linux IIO framework. The driver maintains a static array named veml6075_it_ms that maps integration time register values to their millisecond equivalents. This array is sized for 5 valid configurations. The register field defined by VEML6075_CONF_IT, however, is 3 bits wide and can hold values from 0 through 7. Values 5, 6, and 7 are marked reserved in the device datasheet and should never appear in normal operation.
When the driver reads the integration time from the hardware register, it uses the returned value as a direct array index without validation. If the register returns a reserved value, the driver reads past the end of veml6075_it_ms. This constitutes an out-of-bounds read [CWE-125] within kernel memory.
Root Cause
The root cause is missing input validation on data returned from a hardware register. The driver trusted the device to return only defined values. Reserved bit patterns produced by faulty hardware, misprogramming, or I2C bus corruption bypass this implicit assumption and cause the index to reference invalid memory.
Attack Vector
Exploitation requires local access with permissions to interact with the IIO sysfs interface or the underlying I2C bus. An attacker who can influence register content, or a defective sensor on a shared bus, can trigger the out-of-bounds access. The condition may leak adjacent kernel memory contents through the returned integration time value or destabilize the kernel. The fix hardens the driver against fault devices, misprogramming, and bus corruption.
Detection Methods for CVE-2026-53387
Indicators of Compromise
- Unexpected -EINVAL returns from veml6075 IIO read operations after applying the patch
- Kernel log entries referencing anomalous integration time values or IIO channel read failures
- KASAN or UBSAN reports flagging out-of-bounds access inside veml6075_read_int_time_ms or related functions
Detection Strategies
- Enable CONFIG_KASAN on test kernels to surface out-of-bounds array accesses in IIO drivers
- Audit installed kernel packages against fixed commits 0a89002, 307dc42, df9127a, e545936, and f75beeb
- Monitor sysfs read patterns against /sys/bus/iio/devices/ for anomalous access to VEML6075 device nodes
Monitoring Recommendations
- Collect kernel ring buffer logs (dmesg) centrally and alert on IIO subsystem errors
- Track loaded kernel modules and version strings across the fleet to identify unpatched hosts running veml6075
- Correlate I2C bus errors with sensor driver failures to detect hardware faults that may trigger the condition
How to Mitigate CVE-2026-53387
Immediate Actions Required
- Apply the upstream stable kernel updates containing the bounds check fix
- Identify systems running the veml6075 driver by inspecting loaded modules with lsmod | grep veml6075
- Restrict local access to IIO sysfs entries to trusted users through file permissions and ACLs
Patch Information
The fix is available in the mainline Linux kernel and stable branches through the following commits: Kernel Git Commit 0a89002, Kernel Git Commit 307dc42, Kernel Git Commit df9127a, Kernel Git Commit e545936, and Kernel Git Commit f75beeb. The patch adds a bounds check on the veml6075_it_ms array index and returns -EINVAL when the value exceeds the array size.
Workarounds
- Unload the veml6075 module on systems that do not require UV sensor functionality using modprobe -r veml6075
- Blacklist the driver by adding blacklist veml6075 to /etc/modprobe.d/ on affected hosts pending patch deployment
- Enforce strict permissions on /sys/bus/iio/devices/ to prevent unprivileged access to sensor read paths
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
