CVE-2026-63965

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack leak exists in the bmp580 trigger handler() function. The function declares a scan buffer on the stack without an initializer and uses memcpy() to copy 3 bytes of 24-bit sensor data into each 4-byte le32 field. This process leaves the high byte of comp temp and comp press uninitialized. Because the channel storagebits is 32, two bytes of uninitialized stack memory are leaked to userspace during each scan.

Recommendations Zero-initialize the structure on the stack within the bmp580 trigger handler() function.