The Linux kernel iio light driver for the veml6075 sensor contained a vulnerability where the veml6075_it_ms array, which has 5 elements, could be indexed with values up to 7 due to the VEML6075_CONF_IT register yielding values from 0 to 7. This could cause an out-of-bounds array access. The fix adds a bounds check to ensure the index is within range and returns -EINVAL if it is not. The out-of-range values are reserved and should not normally be read, so this fix is a hardening measure against hardware faults, misprogramming, or bus corruption.

An out-of-bounds array access could occur if the index value is 5 or greater, which may lead to undefined behavior or kernel instability. However, since the problematic values are reserved and should not be read from the device register, the vulnerability is primarily a hardening improvement rather than a widely exploitable flaw.

A fix has been implemented in the Linux kernel by adding a bounds check to the veml6075_it_ms index. Users should update to a Linux kernel version that includes this fix. No additional mitigation is required as the issue is addressed by this official fix.