CVE-2026-63934

In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: itg3200: fix i2c read into the wrong stack location

itg3200readallchannels() takes __be16 *buf' as a parameter and fills the i2c_msg destination as(char *)&buf'. Since buf' is the parameter (a pointer),&buf' is the address of the local pointer slot on the stack of itg3200readallchannels(), not the address of the caller's scan buffer. The (char *) cast hides the type mismatch.

i2ctransfer() therefore writes ITG3200SCANELEMENTS * sizeof(s16) = 8 bytes into the parameter's stack slot, which is discarded when the function returns. The caller's scan buffer in itg3200triggerhandler() is never written to, so iiopushtobufferswithtimestamp() pushes uninitialised stack contents to userspace via /dev/iio:deviceX every scan -- both a functional bug (no actual gyroscope or temperature data is delivered through the triggered buffer) and an information leak.

The non-buffered readraw() path is unaffected: it goes through itg3200readregs16() which uses `&out' on a local s16 value, where that is correct.

Drop the spurious `&' so the i2c read writes into the caller's buffer.