CVE-2026-63934

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: itg3200: fix i2c read into the wrong stack location

itg3200_read_all_channels() takes `__be16 *buf' as a parameter and

fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the

parameter (a pointer), `&buf' is the address of the local pointer

slot on the stack of itg3200_read_all_channels(), not the address

of the caller's scan buffer. The (char *) cast hides the type

mismatch.

i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)

= 8 bytes into the parameter's stack slot, which is discarded when

the function returns. The caller's scan buffer in

itg3200_trigger_handler() is never written to, so

iio_push_to_buffers_with_timestamp() pushes uninitialised stack

contents to userspace via /dev/iio:deviceX every scan -- both a

functional bug (no actual gyroscope or temperature data is

delivered through the triggered buffer) and an information leak.

The non-buffered read_raw() path is una

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References