CVE-2026-63934

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the itg3200 read all channels() function where an incorrect memory address is used during an I2C read operation. The function incorrectly uses the address of the local pointer buf instead of the address it points to, causing data to be written into the stack rather than the intended scan buffer. Consequently, iio push to buffers with timestamp() transmits uninitialized stack contents to userspace via the /dev/iio:deviceX endpoint, resulting in an information leak and a failure to deliver actual gyroscope or temperature data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.