In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: itg3200: fix i2c read into the wrong stack location
itg3200_read_all_channels() takes `__be16 *buf' as a parameter and
fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the
parameter (a pointer), `&buf' is the address of the local pointer
slot on the stack of itg3200_read_all_channels(), not the address
of the caller's scan buffer. The (char *) cast hides the type
mismatch.
i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)
= 8 bytes into the parameter's stack slot, which is discarded when
the function returns. The caller's scan buffer in
itg3200_trigger_handler() is never written to, so
iio_push_to_buffers_with_timestamp() pushes uninitialised stack
contents to userspace via /dev/iio:deviceX every scan -- both a
functional bug (no actual gyroscope or temperature data is
delivered through the triggered buffer) and an information leak.
The non-buffered read_raw() path is unaffected: it goes through
itg3200_read_reg_s16() which uses `&out' on a local s16 value,
where that is correct.
Drop the spurious `&' so the i2c read writes into the caller's
buffer.
References
Configurations
Configuration 1 (hide)
|
History
30 Oct 2026, 14:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| CWE | CWE-125 | |
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1 - Patch | |
| References | () https://git.kernel.org/stable/c/31bbd4b87dd6701fa10e03ba7f6268e49e178d16 - Patch | |
| References | () https://git.kernel.org/stable/c/63203bd072b613c18c237b906b1c9d2dc4527337 - Patch | |
| References | () https://git.kernel.org/stable/c/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae - Patch | |
| References | () https://git.kernel.org/stable/c/8654b5e2617819ff4f7c78071dfd0275e971a9b6 - Patch | |
| References | () https://git.kernel.org/stable/c/90e809376b0f0d1ddec2eec954aecdd2a5b40b0e - Patch | |
| References | () https://git.kernel.org/stable/c/b64dd5f3b38911054cbcc570df617e3e8e75e562 - Patch | |
| References | () https://git.kernel.org/stable/c/cfc3283859cfdeacadf80d5e6880bdf871ffeaa6 - Patch |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-30 14:28
NVD link : CVE-2026-63934
Mitre link : CVE-2026-63934
CVE.ORG link : CVE-2026-63934
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-125
Out-of-bounds Read