CVE-2026-63966 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16550: fix stack leak in trigger handler adis16550_trigger_handler() declares the scan data array on the stack without initializing it. The memcpy() at the bottom fills only the first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the 8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data which leaks to userspace on ever trigger. Fix this all by just zero-initializing the structure on the stack.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00198.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/474f8928d50b09f7dcf507049f08732640b88b49
https://git.kernel.org/stable/c/c2c255444392872cbbf46d640cb3a938e8000309
https://git.kernel.org/stable/c/ce582b22dd2ff15ac99101c22ec1559d1febe2ff

History

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16550: fix stack leak in trigger handler adis16550_trigger_handler() declares the scan data array on the stack without initializing it. The memcpy() at the bottom fills only the first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the 8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data which leaks to userspace on ever trigger. Fix this all by just zero-initializing the structure on the stack.
Title		iio: imu: adis16550: fix stack leak in trigger handler
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/474f8928d50b09f7dcf507049f08732640b88b49 https://git.kernel.org/stable/c/c2c255444392872cbbf46d640cb3a938e8000309 https://git.kernel.org/stable/c/ce582b22dd2ff15ac99101c22ec1559d1febe2ff

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:54.391Z

Updated: 2026-07-19T14:55:54.391Z

Reserved: 2026-07-19T07:54:57.024Z

Link: CVE-2026-63966

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63966", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.024Z", "datePublished": "2026-07-19T14:55:54.391Z", "dateUpdated": "2026-07-19T14:55:54.391Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T14:55:54.391Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: adis16550: fix stack leak in trigger handler\n\nadis16550_trigger_handler() declares the scan data array on the stack\nwithout initializing it. The memcpy() at the bottom fills only the\nfirst 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and\niio_push_to_buffers_with_timestamp() writes the s64 timestamp at the\n8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data\nwhich leaks to userspace on ever trigger.\n\nFix this all by just zero-initializing the structure on the stack."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/imu/adis16550.c"], "versions": [{"version": "e4570f4bb231f01e32d44fd38841665f340d6914", "lessThan": "ce582b22dd2ff15ac99101c22ec1559d1febe2ff", "status": "affected", "versionType": "git"}, {"version": "e4570f4bb231f01e32d44fd38841665f340d6914", "lessThan": "c2c255444392872cbbf46d640cb3a938e8000309", "status": "affected", "versionType": "git"}, {"version": "e4570f4bb231f01e32d44fd38841665f340d6914", "lessThan": "474f8928d50b09f7dcf507049f08732640b88b49", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/imu/adis16550.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ce582b22dd2ff15ac99101c22ec1559d1febe2ff"}, {"url": "https://git.kernel.org/stable/c/c2c255444392872cbbf46d640cb3a938e8000309"}, {"url": "https://git.kernel.org/stable/c/474f8928d50b09f7dcf507049f08732640b88b49"}], "title": "iio: imu: adis16550: fix stack leak in trigger handler", "x_generator": {"engine": "bippy-1.2.0"}}}}