The Linux kernel's platform/chrome sensorhub component processes events from an embedded controller (EC) FIFO, each carrying an 8-bit sensor number. While the event count and ring bounds were validated, the sensor number was not checked before being used to index the batch_state array. This array is allocated based on the sensor_num count, so an out-of-range sensor number could cause out-of-bounds read and write operations. The fix adds validation of the sensor number in the ring handler to discard malformed events before they can cause memory corruption.

An attacker able to supply malformed EC FIFO events could trigger out-of-bounds memory access, potentially leading to memory corruption. This could affect system stability or security depending on the context in which the sensorhub operates. No active exploits are known in the wild.

A fix has been implemented that validates the sensor number before processing events, dropping malformed events early. Users should apply the official Linux kernel update containing this fix once available. No additional mitigation steps are indicated.