Riskcovery

CVE-2026-63966

iio: imu: adis16550: fix stack leak in trigger handler

State
Published
Severity
Not scored
Published
Jul 19, 2026
Updated
Jul 19, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: imu: adis16550: fix stack leak in trigger handler

adis16550_trigger_handler() declares the scan data array on the stack without initializing it. The memcpy() at the bottom fills only the first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the 8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data which leaks to userspace on ever trigger.

Fix this all by just zero-initializing the structure on the stack.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e4570f4bb231f01e32d44fd38841665f340d6914 to before ce582b22dd2ff15ac99101c22ec1559d1febe2ffAffected
  • e4570f4bb231f01e32d44fd38841665f340d6914 to before c2c255444392872cbbf46d640cb3a938e8000309Affected
  • e4570f4bb231f01e32d44fd38841665f340d6914 to before 474f8928d50b09f7dcf507049f08732640b88b49Affected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.18.35 through 6.18.*Not affected
  • 7.0.12 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.