CVE-2026-63934

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63934
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63934.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-63934
Downstream
Related
Published
2026-07-19T14:55:32Z
Modified
2026-08-31T18:27:01Z
Summary
iio: gyro: itg3200: fix i2c read into the wrong stack location
Details

In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: itg3200: fix i2c read into the wrong stack location

itg3200_read_all_channels() takes __be16 *buf' as a parameter and fills the i2c_msg destination as (char *)&buf'. Since buf' is the parameter (a pointer), &buf' is the address of the local pointer slot on the stack of itg3200_read_all_channels(), not the address of the caller's scan buffer. The (char *) cast hides the type mismatch.

i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16) = 8 bytes into the parameter's stack slot, which is discarded when the function returns. The caller's scan buffer in itg3200_trigger_handler() is never written to, so iio_push_to_buffers_with_timestamp() pushes uninitialised stack contents to userspace via /dev/iio:deviceX every scan -- both a functional bug (no actual gyroscope or temperature data is delivered through the triggered buffer) and an information leak.

The non-buffered read_raw() path is unaffected: it goes through itg3200_read_reg_s16() which uses `&out' on a local s16 value, where that is correct.

Drop the spurious `&' so the i2c read writes into the caller's buffer.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63934.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9dbf091da080508e9f632d307f357beb79a0766b
Fixed
90e809376b0f0d1ddec2eec954aecdd2a5b40b0e
Fixed
8654b5e2617819ff4f7c78071dfd0275e971a9b6
Fixed
b64dd5f3b38911054cbcc570df617e3e8e75e562
Fixed
31bbd4b87dd6701fa10e03ba7f6268e49e178d16
Fixed
63203bd072b613c18c237b906b1c9d2dc4527337
Fixed
15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1
Fixed
cfc3283859cfdeacadf80d5e6880bdf871ffeaa6
Fixed
6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63934.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.9.0
Fixed
5.10.259
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.210
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.176
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.143
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.93
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.35
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.12

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63934.json"