Stack Leak Vulnerability in BMP280 Pressure Sensor Driver by Linux Kernel

CVE-2026-63965

What is CVE-2026-63965?

A vulnerability in the BMP280 pressure sensor driver of the Linux kernel arises from an uninitialized stack buffer during data transfer to user space. Specifically, the bmp580_trigger_handler() inadvertently leaves the high byte of compression temperature and pressure uninitialized, leading to a leak of sensitive data. Previously, a related buffer was managed in private data, which implicitly provided zeroing; however, the transition to stack allocation resulted in this oversight. The fix involves ensuring that the stack structure is explicitly zero-initialized, thereby mitigating the risk of unintended data exposure.

References