CVE-2026-63966

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iio: imu: adis16550: fix stack leak in trigger handler

adis16550_trigger_handler() declares the scan data array on the stack

without initializing it. The memcpy() at the bottom fills only the

first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and

iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the

8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data

which leaks to userspace on ever trigger.

Fix this all by just zero-initializing the structure on the stack.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References