The Linux kernel iio light sensor driver for veml6075 had a vulnerability where the veml6075_it_ms array, which contains 5 elements, could be accessed out-of-bounds because the VEML6075_CONF_IT register can produce values from 0 to 7. If the register returns a value greater than or equal to 5, this results in an out-of-bounds array access. The vulnerability was addressed by adding a bounds check that returns -EINVAL if the index is out of range. The out-of-range values are reserved and should not normally be read, so this fix serves as a hardening measure against faults, misprogramming, or bus corruption.

An out-of-bounds array access in kernel code can lead to denial of service (crash) or potentially other impacts depending on memory layout. The CVSS score of 7.1 with high confidentiality impact and high availability impact indicates that the vulnerability could lead to significant disruption or information exposure if exploited. However, the problem values are reserved and should not normally occur, so exploitation is likely difficult.

A fix has been implemented in the Linux kernel by adding a bounds check to the veml6075_it_ms index. Users should update to a Linux kernel version that includes this fix. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. No additional mitigation steps are indicated.