CVE-2024-57906

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description The issue concerns an information leak in the triggered buffer of the ti-ads8688 driver in the Linux kernel. The buffer local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio for each active channel() to assign new values. This can lead to pushing uninitialized information to userspace. The array needs to be initialized to zero before use to avoid this issue.

Recommendations For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider initializing the buffer array to zero before using it to avoid pushing uninitialized information to userspace.