PT-2026-61251 · Linux · Linux
CVE-2026-63934
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: itg3200: fix i2c read into the wrong stack location
itg3200 read all channels() takes
be16 *buf' as a parameter and fills the i2c msg destination as(char *)&buf'. Since buf' is the parameter (a pointer), &buf' is the address of the local pointer
slot on the stack of itg3200 read all channels(), not the address
of the caller's scan buffer. The (char *) cast hides the type
mismatch.i2c transfer() therefore writes ITG3200 SCAN ELEMENTS * sizeof(s16)
= 8 bytes into the parameter's stack slot, which is discarded when
the function returns. The caller's scan buffer in
itg3200 trigger handler() is never written to, so
iio push to buffers with timestamp() pushes uninitialised stack
contents to userspace via /dev/iio:deviceX every scan -- both a
functional bug (no actual gyroscope or temperature data is
delivered through the triggered buffer) and an information leak.
The non-buffered read raw() path is unaffected: it goes through
itg3200 read reg s16() which uses `&out' on a local s16 value,
where that is correct.
Drop the spurious `&' so the i2c read writes into the caller's
buffer.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux