Stack Leak Vulnerability in ST_LSM6DSX IMU Driver from Linux Kernel

CVE-2026-63967

What is CVE-2026-63967?

A vulnerability in the ST_LSM6DSX IMU driver within the Linux kernel was identified, where a stack-allocated structure, iio_buff, was not properly initialized. This oversight could potentially allow uninitialized data to be copied to userspace, resulting in a stack leak. The vulnerability arises from the way the tagged FIFO path declares the structure without setting initial values, creating gaps that expose sensitive data. The issue has been addressed in the Linux kernel by ensuring the structure is zero-initialized before use, enhancing data integrity and overall security.

References