{"id":"CVE-2026-63967","state":"PUBLISHED","title":"iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer\n\nThe tagged FIFO path declares iio_buff on the stack with __aligned(8)\nbut no initializer, but there is a hole in the structure, which will\nthen leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be\ncopied, but the space between that and the timestamp are not\ninitialized.\n\nCommit c14edb4d0bdc (\"iio:imu:st_lsm6dsx Fix alignment and data leak\nissues\") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan,\nbut for the tagged path it only added the alignment qualifier and not\nthe initializer :(\n\nFix this by just zero-initializing the structure on the stack.","publishedAt":"2026-07-19T14:55:54.999Z","updatedAt":"2026-07-19T14:55:54.999Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"ff8d3c088b77b11782f2c3b97e37425be050e8de","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"fe1a7f99e72ebd2880515332b79b8c256be22aca","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"babf1943a40bb5669db57d30ca16c22504b18e07","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"d42ac0bfb6a16617c62a59d53706579c7fadbfa6","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"3147b303b8c7d9f91da4b849ece33b45048f5eaf","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"e6bb3a49c5f9de870ea95e69775df785728e3366","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"890d0312d5f94be43eac21f5a34d3bccc60d051b","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"c9d8e9adaa63150ef7e833480b799d0bab83a276","versionType":"git"},{"version":"a42ca3b182ccb766666a0be1053921cba190e2de","status":"affected","versionType":"git"},{"version":"5.9.5","status":"affected","lessThan":"5.10","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.93","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.35","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.12","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"]}],"references":["https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de","https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca","https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07","https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6","https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf","https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366","https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b","https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/63xxx/CVE-2026-63967.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63967","state":"PUBLISHED","datePublished":"2026-07-19T14:55:54.999Z","dateUpdated":"2026-07-19T14:55:54.999Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.024Z"},"containers":{"cna":{"title":"iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer\n\nThe tagged FIFO path declares iio_buff on the stack with __aligned(8)\nbut no initializer, but there is a hole in the structure, which will\nthen leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be\ncopied, but the space between that and the timestamp are not\ninitialized.\n\nCommit c14edb4d0bdc (\"iio:imu:st_lsm6dsx Fix alignment and data leak\nissues\") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan,\nbut for the tagged path it only added the alignment qualifier and not\nthe initializer :(\n\nFix this by just zero-initializing the structure on the stack."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"ff8d3c088b77b11782f2c3b97e37425be050e8de","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"fe1a7f99e72ebd2880515332b79b8c256be22aca","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"babf1943a40bb5669db57d30ca16c22504b18e07","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"d42ac0bfb6a16617c62a59d53706579c7fadbfa6","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"3147b303b8c7d9f91da4b849ece33b45048f5eaf","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"e6bb3a49c5f9de870ea95e69775df785728e3366","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"890d0312d5f94be43eac21f5a34d3bccc60d051b","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","status":"affected","lessThan":"c9d8e9adaa63150ef7e833480b799d0bab83a276","versionType":"git"},{"version":"a42ca3b182ccb766666a0be1053921cba190e2de","status":"affected","versionType":"git"},{"version":"5.9.5","status":"affected","lessThan":"5.10","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.93","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.35","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.12","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de"},{"url":"https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca"},{"url":"https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07"},{"url":"https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6"},{"url":"https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf"},{"url":"https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366"},{"url":"https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b"},{"url":"https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-07-19T14:55:54.999Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"7.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9.5"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}