Uninitialized Stack Data Exposure in Linux Kernel by Vendor

CVE-2025-39690

What is CVE-2025-39690?

In the Linux kernel, a potential issue has been identified in the IIO: accel driver for the sca3300 component, where uninitialized stack data could be inadvertently exposed to userspace applications. This vulnerability arises from the failure to zero out the 'channels' array before its use. To rectify this issue, measures have been implemented to ensure that this array is properly initialized, thus preventing the leakage of sensitive data. This fix emphasizes the importance of initializing stack data in driver development for enhanced security.

References