CVE-2026-63966
- Source
- https://cve.org/CVERecord?id=CVE-2026-63966
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63966.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-63966
- Downstream
- Published
- 2026-07-19T14:55:54.391Z
- Modified
- 2026-07-21T03:47:40.892469279Z
- Summary
- iio: imu: adis16550: fix stack leak in trigger handler
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
iio: imu: adis16550: fix stack leak in trigger handler
adis16550triggerhandler() declares the scan data array on the stack without initializing it. The memcpy() at the bottom fills only the first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and iiopushtobufferswith_timestamp() writes the s64 timestamp at the 8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data which leaks to userspace on ever trigger.
Fix this all by just zero-initializing the structure on the stack.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63966.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/474f8928d50b09f7dcf507049f08732640b88b49
- https://git.kernel.org/stable/c/c2c255444392872cbbf46d640cb3a938e8000309
- https://git.kernel.org/stable/c/ce582b22dd2ff15ac99101c22ec1559d1febe2ff
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63966.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-63966
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git