Executive brief
A vulnerability was identified in the Linux kernel's driver for the SPS30 particulate matter sensor. An error in how the system calculates memory buffer sizes could lead to memory corruption. This could potentially allow a local attacker to crash the system or gain unauthorized access to sensitive information.
Technical details
A buffer size calculation error exists in the Linux kernel's 'sps30_i2c' driver within the 'sps30_i2c_read_meas()' function. The code incorrectly used 'sizeof(num)' (the size of the count variable, typically 8 bytes on 64-bit systems) instead of 'sizeof(*meas)' (the size of the actual data element, 4 bytes) when determining the buffer length for I2C commands. This mismatch can lead to out-of-bounds memory access or corruption during sensor data reads. The vulnerability is reachable locally if the SPS30 chemical sensor is present and the driver is loaded. Patches have been merged into multiple stable kernel branches to correct the calculation to use the proper element size.
Affected products
- Linux Linux Kernel All versions prior to the fix in the sps30_i2c driver
Timeline
- 2026-02-12: other: Vulnerability fixed in source code by Antoniu Miclaus
- 2026-05-13: advisory: CVE-2026-43476 published by NVD
References
- https://git.kernel.org/stable/c/08881d82f94deaa51800360029908863e5c4c39d
- https://git.kernel.org/stable/c/165f12b40901c6a7aca15796da239726ddcdc5ad
- https://git.kernel.org/stable/c/216345f98cae7fcc84f49728c67478ac00321c87
- https://git.kernel.org/stable/c/2a4d111a6a34afb8bb4f118009e7728ed2ec7e10
- https://git.kernel.org/stable/c/90e978ace598567e6e30de79805bddf37cf892ac
- https://git.kernel.org/stable/c/9aff2e9c2927ecd9652872a43a0725f101128104
- https://git.kernel.org/stable/c/dcdf1e92674efb6692f4ebe189e0aa9fde23a541