CVE-2026-63967 (GCVE-0-2026-63967)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-07-19 14:55
VLAI
Title
iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares iio_buff on the stack with __aligned(8) but no initializer, but there is a hole in the structure, which will then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be copied, but the space between that and the timestamp are not initialized. Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan, but for the tagged path it only added the alignment qualifier and not the initializer :( Fix this by just zero-initializing the structure on the stack.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 , < ff8d3c088b77b11782f2c3b97e37425be050e8de (git)
Affected: c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 , < fe1a7f99e72ebd2880515332b79b8c256be22aca (git)
Affected: c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 , < babf1943a40bb5669db57d30ca16c22504b18e07 (git)
Affected: c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 , < d42ac0bfb6a16617c62a59d53706579c7fadbfa6 (git)
Affected: c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 , < 3147b303b8c7d9f91da4b849ece33b45048f5eaf (git)
Affected: c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 , < e6bb3a49c5f9de870ea95e69775df785728e3366 (git)
Affected: c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 , < 890d0312d5f94be43eac21f5a34d3bccc60d051b (git)
Affected: c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 , < c9d8e9adaa63150ef7e833480b799d0bab83a276 (git)
Affected: a42ca3b182ccb766666a0be1053921cba190e2de (git)
Affected: 5.9.5 , < 5.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff8d3c088b77b11782f2c3b97e37425be050e8de",
              "status": "affected",
              "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
              "versionType": "git"
            },
            {
              "lessThan": "fe1a7f99e72ebd2880515332b79b8c256be22aca",
              "status": "affected",
              "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
              "versionType": "git"
            },
            {
              "lessThan": "babf1943a40bb5669db57d30ca16c22504b18e07",
              "status": "affected",
              "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
              "versionType": "git"
            },
            {
              "lessThan": "d42ac0bfb6a16617c62a59d53706579c7fadbfa6",
              "status": "affected",
              "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
              "versionType": "git"
            },
            {
              "lessThan": "3147b303b8c7d9f91da4b849ece33b45048f5eaf",
              "status": "affected",
              "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
              "versionType": "git"
            },
            {
              "lessThan": "e6bb3a49c5f9de870ea95e69775df785728e3366",
              "status": "affected",
              "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
              "versionType": "git"
            },
            {
              "lessThan": "890d0312d5f94be43eac21f5a34d3bccc60d051b",
              "status": "affected",
              "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
              "versionType": "git"
            },
            {
              "lessThan": "c9d8e9adaa63150ef7e833480b799d0bab83a276",
              "status": "affected",
              "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a42ca3b182ccb766666a0be1053921cba190e2de",
              "versionType": "git"
            },
            {
              "lessThan": "5.10",
              "status": "affected",
              "version": "5.9.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.9.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer\n\nThe tagged FIFO path declares iio_buff on the stack with __aligned(8)\nbut no initializer, but there is a hole in the structure, which will\nthen leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be\ncopied, but the space between that and the timestamp are not\ninitialized.\n\nCommit c14edb4d0bdc (\"iio:imu:st_lsm6dsx Fix alignment and data leak\nissues\") moved the untagged FIFO path to a kzalloc\u0027d buffer in hw-\u003escan,\nbut for the tagged path it only added the alignment qualifier and not\nthe initializer :(\n\nFix this by just zero-initializing the structure on the stack."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:55:54.999Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca"
        },
        {
          "url": "https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07"
        },
        {
          "url": "https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366"
        },
        {
          "url": "https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276"
        }
      ],
      "title": "iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63967",
    "datePublished": "2026-07-19T14:55:54.999Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-07-19T14:55:54.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63967",
      "date": "2026-09-20",
      "epss": "0.00211",
      "percentile": "0.1163"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ff8d3c088b77b11782f2c3b97e37425be050e8de",
                    "status": "affected",
                    "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fe1a7f99e72ebd2880515332b79b8c256be22aca",
                    "status": "affected",
                    "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "babf1943a40bb5669db57d30ca16c22504b18e07",
                    "status": "affected",
                    "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d42ac0bfb6a16617c62a59d53706579c7fadbfa6",
                    "status": "affected",
                    "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3147b303b8c7d9f91da4b849ece33b45048f5eaf",
                    "status": "affected",
                    "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e6bb3a49c5f9de870ea95e69775df785728e3366",
                    "status": "affected",
                    "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "890d0312d5f94be43eac21f5a34d3bccc60d051b",
                    "status": "affected",
                    "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c9d8e9adaa63150ef7e833480b799d0bab83a276",
                    "status": "affected",
                    "version": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "a42ca3b182ccb766666a0be1053921cba190e2de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "affected",
                    "version": "5.9.5",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer\n\nThe tagged FIFO path declares iio_buff on the stack with __aligned(8)\nbut no initializer, but there is a hole in the structure, which will\nthen leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be\ncopied, but the space between that and the timestamp are not\ninitialized.\n\nCommit c14edb4d0bdc (\"iio:imu:st_lsm6dsx Fix alignment and data leak\nissues\") moved the untagged FIFO path to a kzalloc\u0027d buffer in hw-\u003escan,\nbut for the tagged path it only added the alignment qualifier and not\nthe initializer :(\n\nFix this by just zero-initializing the structure on the stack."
          }
        ],
        "id": "CVE-2026-63967",
        "lastModified": "2026-07-30T14:51:11.223",
        "metrics": {},
        "published": "2026-07-19T16:17:15.700",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-07T13:50:24+00:00",
      "cve": "CVE-2026-63967",
      "id": "CVE-2026-63967",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63967.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:45:41Z",
      "cve": "CVE-2026-63967",
      "id": "CVE-2026-63967",
      "initial_release_date": "2026-07-21T13:02:33Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "528",
      "product_status:known_not_affected": "193",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63967",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63967.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.