The simulated EEPROM driver contains an integer overflow in the `eeprom range is valid()` function within `drivers/eeprom/eeprom simulator.c`. The validation check `(offset + len) <= config->size` uses a signed `off t` for `offset` and an unsigned `size t` for `len`. This causes the addition to be evaluated using unsigned arithmetic, allowing a negative `offset` combined with a large `len` to wrap around and pass the range check. Consequently, `eeprom sim read()` and `eeprom sim write()` can perform `memcpy()` operations on memory located before the `mock eeprom` array via pointer arithmetic.
Since `eeprom read()` and `eeprom write()` are system call entry points that do not validate the `offset` argument, an unprivileged thread in a build with `CONFIG USERSPACE=y` and a `CONFIG EEPROM SIMULATOR` instance can trigger this behavior. This allows an attacker to perform out-of-bounds reads of kernel `.bss` memory or out-of-bounds writes to kernel memory preceding the `mock eeprom` array, potentially leading to kernel state corruption and a user-mode sandbox escape.