The Linux kernel's iio gyro driver for the bmg160 sensor contained a vulnerability where functions bmg160_get_filter() and bmg160_set_filter() accessed an array beyond its bounds if the bandwidth/filter value read from the chip did not match any entry in bmg160_samp_freq_table[]. This out-of-bounds read occurs because the code does not properly handle the case when no matching entry is found, leading to reading one slot past the end of the array. The set_filter() function is reachable from userspace via the sysfs interface in_anglvel_filter_low_pass_3db_frequency, allowing trivial triggering of the out-of-bounds read. The fix involves returning -EINVAL when no matching entry is found, preventing the buffer overflow.

An out-of-bounds read vulnerability in the kernel driver can lead to undefined behavior, potentially causing system instability or information disclosure. Since the vulnerable code is reachable from userspace via a sysfs interface, a local user can trigger this condition. There is no indication of known exploits in the wild. The impact is limited to local users with access to the sysfs interface for the bmg160 gyro sensor driver.

A fix has been implemented in the Linux kernel to return an error (-EINVAL) when no matching bandwidth/filter entry is found, preventing the out-of-bounds read. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or kernel mailing list advisories for the exact fixed version.