https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 18:18:31 +0000 https://vulnerability.circl.lu/vuln/cve-2026-63934 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iio: gyro: itg3200: fix i2c read into the wrong stack location</p> <p>itg3200_read_all_channels() takes `__be16 *buf&#39; as a parameter and fills the i2c_msg destination as `(char *)&amp;buf&#39;. Since `buf&#39; is the parameter (a pointer), `&amp;buf&#39; is the address of the local pointer slot on the stack of itg3200_read_all_channels(), not the address of the caller&#39;s scan buffer. The (char *) cast hides the type mismatch.</p> <p>i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16) = 8 bytes into the parameter&#39;s stack slot, which is discarded when the function returns. The caller&#39;s scan buffer in itg3200_trigger_handler() is never written to, so iio_push_to_buffers_with_timestamp() pushes uninitialised stack contents to userspace via /dev/iio:deviceX every scan -- both a functional bug (no actual gyroscope or temperature data is delivered through the triggered buffer) and an information leak.</p> <p>The non-buffered read_raw() path is unaffected: it goes through itg3200_read_reg_s16() which uses `&amp;out&#39; on a local s16 value, where that is correct.</p> <p>Drop the spurious `&amp;&#39; so the i2c read writes into the caller&#39;s buffer.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iio: gyro: itg3200: fix i2c read into the wrong stack location</p> <p>itg3200_read_all_channels() takes `__be16 *buf&#39; as a parameter and fills the i2c_msg destination as `(char *)&amp;buf&#39;. Since `buf&#39; is the parameter (a pointer), `&amp;buf&#39; is the address of the local pointer slot on the stack of itg3200_read_all_channels(), not the address of the caller&#39;s scan buffer. The (char *) cast hides the type mismatch.</p> <p>i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16) = 8 bytes into the parameter&#39;s stack slot, which is discarded when the function returns. The caller&#39;s scan buffer in itg3200_trigger_handler() is never written to, so iio_push_to_buffers_with_timestamp() pushes uninitialised stack contents to userspace via /dev/iio:deviceX every scan -- both a functional bug (no actual gyroscope or temperature data is delivered through the triggered buffer) and an information leak.</p> <p>The non-buffered read_raw() path is unaffected: it goes through itg3200_read_reg_s16() which uses `&amp;out&#39; on a local s16 value, where that is correct.</p> <p>Drop the spurious `&amp;&#39; so the i2c read writes into the caller&#39;s buffer.</p> https://vulnerability.circl.lu/vuln/cve-2026-63934