In the Linux kernel, the following vulnerability has been resolved:
iio: imu: adis16550: fix stack leak in trigger handler
adis16550_trigger_handler() declares the scan data array on the stack
without initializing it. The memcpy() at the bottom fills only the
first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and
iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the
8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data
which leaks to userspace on ever trigger.
Fix this all by just zero-initializing the structure on the stack.
References
Configurations
Configuration 1 (hide)
|
History
30 Oct 2026, 17:25
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-401 | |
| CPE | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/474f8928d50b09f7dcf507049f08732640b88b49 - Patch | |
| References | () https://git.kernel.org/stable/c/c2c255444392872cbbf46d640cb3a938e8000309 - Patch | |
| References | () https://git.kernel.org/stable/c/ce582b22dd2ff15ac99101c22ec1559d1febe2ff - Patch |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-30 17:25
NVD link : CVE-2026-63966
Mitre link : CVE-2026-63966
CVE.ORG link : CVE-2026-63966
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-401
Missing Release of Memory after Effective Lifetime