CVE-2026-63934 (GCVE-0-2026-63934)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-07-19 14:55
VLAI
Title
iio: gyro: itg3200: fix i2c read into the wrong stack location
Summary
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200_read_all_channels() takes `__be16 *buf' as a parameter and fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the parameter (a pointer), `&buf' is the address of the local pointer slot on the stack of itg3200_read_all_channels(), not the address of the caller's scan buffer. The (char *) cast hides the type mismatch. i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16) = 8 bytes into the parameter's stack slot, which is discarded when the function returns. The caller's scan buffer in itg3200_trigger_handler() is never written to, so iio_push_to_buffers_with_timestamp() pushes uninitialised stack contents to userspace via /dev/iio:deviceX every scan -- both a functional bug (no actual gyroscope or temperature data is delivered through the triggered buffer) and an information leak. The non-buffered read_raw() path is unaffected: it goes through itg3200_read_reg_s16() which uses `&out' on a local s16 value, where that is correct. Drop the spurious `&' so the i2c read writes into the caller's buffer.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9dbf091da080508e9f632d307f357beb79a0766b , < 90e809376b0f0d1ddec2eec954aecdd2a5b40b0e (git)
Affected: 9dbf091da080508e9f632d307f357beb79a0766b , < 8654b5e2617819ff4f7c78071dfd0275e971a9b6 (git)
Affected: 9dbf091da080508e9f632d307f357beb79a0766b , < b64dd5f3b38911054cbcc570df617e3e8e75e562 (git)
Affected: 9dbf091da080508e9f632d307f357beb79a0766b , < 31bbd4b87dd6701fa10e03ba7f6268e49e178d16 (git)
Affected: 9dbf091da080508e9f632d307f357beb79a0766b , < 63203bd072b613c18c237b906b1c9d2dc4527337 (git)
Affected: 9dbf091da080508e9f632d307f357beb79a0766b , < 15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1 (git)
Affected: 9dbf091da080508e9f632d307f357beb79a0766b , < cfc3283859cfdeacadf80d5e6880bdf871ffeaa6 (git)
Affected: 9dbf091da080508e9f632d307f357beb79a0766b , < 6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.9
Unaffected: 0 , < 3.9 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/gyro/itg3200_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90e809376b0f0d1ddec2eec954aecdd2a5b40b0e",
              "status": "affected",
              "version": "9dbf091da080508e9f632d307f357beb79a0766b",
              "versionType": "git"
            },
            {
              "lessThan": "8654b5e2617819ff4f7c78071dfd0275e971a9b6",
              "status": "affected",
              "version": "9dbf091da080508e9f632d307f357beb79a0766b",
              "versionType": "git"
            },
            {
              "lessThan": "b64dd5f3b38911054cbcc570df617e3e8e75e562",
              "status": "affected",
              "version": "9dbf091da080508e9f632d307f357beb79a0766b",
              "versionType": "git"
            },
            {
              "lessThan": "31bbd4b87dd6701fa10e03ba7f6268e49e178d16",
              "status": "affected",
              "version": "9dbf091da080508e9f632d307f357beb79a0766b",
              "versionType": "git"
            },
            {
              "lessThan": "63203bd072b613c18c237b906b1c9d2dc4527337",
              "status": "affected",
              "version": "9dbf091da080508e9f632d307f357beb79a0766b",
              "versionType": "git"
            },
            {
              "lessThan": "15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1",
              "status": "affected",
              "version": "9dbf091da080508e9f632d307f357beb79a0766b",
              "versionType": "git"
            },
            {
              "lessThan": "cfc3283859cfdeacadf80d5e6880bdf871ffeaa6",
              "status": "affected",
              "version": "9dbf091da080508e9f632d307f357beb79a0766b",
              "versionType": "git"
            },
            {
              "lessThan": "6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae",
              "status": "affected",
              "version": "9dbf091da080508e9f632d307f357beb79a0766b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/gyro/itg3200_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: itg3200: fix i2c read into the wrong stack location\n\nitg3200_read_all_channels() takes `__be16 *buf\u0027 as a parameter and\nfills the i2c_msg destination as `(char *)\u0026buf\u0027. Since `buf\u0027 is the\nparameter (a pointer), `\u0026buf\u0027 is the address of the local pointer\nslot on the stack of itg3200_read_all_channels(), not the address\nof the caller\u0027s scan buffer. The (char *) cast hides the type\nmismatch.\n\ni2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)\n= 8 bytes into the parameter\u0027s stack slot, which is discarded when\nthe function returns. The caller\u0027s scan buffer in\nitg3200_trigger_handler() is never written to, so\niio_push_to_buffers_with_timestamp() pushes uninitialised stack\ncontents to userspace via /dev/iio:deviceX every scan -- both a\nfunctional bug (no actual gyroscope or temperature data is\ndelivered through the triggered buffer) and an information leak.\n\nThe non-buffered read_raw() path is unaffected: it goes through\nitg3200_read_reg_s16() which uses `\u0026out\u0027 on a local s16 value,\nwhere that is correct.\n\nDrop the spurious `\u0026\u0027 so the i2c read writes into the caller\u0027s\nbuffer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:55:32.681Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90e809376b0f0d1ddec2eec954aecdd2a5b40b0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8654b5e2617819ff4f7c78071dfd0275e971a9b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/b64dd5f3b38911054cbcc570df617e3e8e75e562"
        },
        {
          "url": "https://git.kernel.org/stable/c/31bbd4b87dd6701fa10e03ba7f6268e49e178d16"
        },
        {
          "url": "https://git.kernel.org/stable/c/63203bd072b613c18c237b906b1c9d2dc4527337"
        },
        {
          "url": "https://git.kernel.org/stable/c/15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfc3283859cfdeacadf80d5e6880bdf871ffeaa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae"
        }
      ],
      "title": "iio: gyro: itg3200: fix i2c read into the wrong stack location",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63934",
    "datePublished": "2026-07-19T14:55:32.681Z",
    "dateReserved": "2026-07-19T07:54:57.022Z",
    "dateUpdated": "2026-07-19T14:55:32.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63934",
      "date": "2026-09-21",
      "epss": "0.00211",
      "percentile": "0.11589"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iio/gyro/itg3200_buffer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "90e809376b0f0d1ddec2eec954aecdd2a5b40b0e",
                    "status": "affected",
                    "version": "9dbf091da080508e9f632d307f357beb79a0766b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8654b5e2617819ff4f7c78071dfd0275e971a9b6",
                    "status": "affected",
                    "version": "9dbf091da080508e9f632d307f357beb79a0766b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b64dd5f3b38911054cbcc570df617e3e8e75e562",
                    "status": "affected",
                    "version": "9dbf091da080508e9f632d307f357beb79a0766b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "31bbd4b87dd6701fa10e03ba7f6268e49e178d16",
                    "status": "affected",
                    "version": "9dbf091da080508e9f632d307f357beb79a0766b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63203bd072b613c18c237b906b1c9d2dc4527337",
                    "status": "affected",
                    "version": "9dbf091da080508e9f632d307f357beb79a0766b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1",
                    "status": "affected",
                    "version": "9dbf091da080508e9f632d307f357beb79a0766b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cfc3283859cfdeacadf80d5e6880bdf871ffeaa6",
                    "status": "affected",
                    "version": "9dbf091da080508e9f632d307f357beb79a0766b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae",
                    "status": "affected",
                    "version": "9dbf091da080508e9f632d307f357beb79a0766b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iio/gyro/itg3200_buffer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.9"
                  },
                  {
                    "lessThan": "3.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: itg3200: fix i2c read into the wrong stack location\n\nitg3200_read_all_channels() takes `__be16 *buf\u0027 as a parameter and\nfills the i2c_msg destination as `(char *)\u0026buf\u0027. Since `buf\u0027 is the\nparameter (a pointer), `\u0026buf\u0027 is the address of the local pointer\nslot on the stack of itg3200_read_all_channels(), not the address\nof the caller\u0027s scan buffer. The (char *) cast hides the type\nmismatch.\n\ni2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)\n= 8 bytes into the parameter\u0027s stack slot, which is discarded when\nthe function returns. The caller\u0027s scan buffer in\nitg3200_trigger_handler() is never written to, so\niio_push_to_buffers_with_timestamp() pushes uninitialised stack\ncontents to userspace via /dev/iio:deviceX every scan -- both a\nfunctional bug (no actual gyroscope or temperature data is\ndelivered through the triggered buffer) and an information leak.\n\nThe non-buffered read_raw() path is unaffected: it goes through\nitg3200_read_reg_s16() which uses `\u0026out\u0027 on a local s16 value,\nwhere that is correct.\n\nDrop the spurious `\u0026\u0027 so the i2c read writes into the caller\u0027s\nbuffer."
          }
        ],
        "id": "CVE-2026-63934",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {},
        "published": "2026-07-19T16:17:11.857",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/31bbd4b87dd6701fa10e03ba7f6268e49e178d16"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/63203bd072b613c18c237b906b1c9d2dc4527337"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8654b5e2617819ff4f7c78071dfd0275e971a9b6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/90e809376b0f0d1ddec2eec954aecdd2a5b40b0e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b64dd5f3b38911054cbcc570df617e3e8e75e562"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cfc3283859cfdeacadf80d5e6880bdf871ffeaa6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-07T13:50:13+00:00",
      "cve": "CVE-2026-63934",
      "id": "CVE-2026-63934",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iio: gyro: itg3200: fix i2c read into the wrong stack location",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63934.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-10T02:30:01Z",
      "cve": "CVE-2026-63934",
      "id": "CVE-2026-63934",
      "initial_release_date": "2026-07-21T13:03:14Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "671",
      "product_status:known_not_affected": "50",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63934",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63934.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.