Not yet scoredPublished Jul 19, 2026

CVE-2026-63967iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer

Updated under an hour ago (Oct 29, 2026, 5:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares iio_buff on the stack with __aligned(8) but no initializer, but there is a hole in the structure, which will then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be copied, but the space between that and the timestamp are not initialized. Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan, but for the tagged path it only added the alignment qualifier and not the initializer :( Fix this by just zero-initializing the structure on the stack.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 before ff8d3c088b77b11782f2c3b97e37425be050e8de; from c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 before fe1a7f99e72ebd2880515332b79b8c256be22aca; from c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 before babf1943a40bb5669db57d30ca16c22504b18e07; from c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 before d42ac0bfb6a16617c62a59d53706579c7fadbfa6; from c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 before 3147b303b8c7d9f91da4b849ece33b45048f5eaf; from c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 before e6bb3a49c5f9de870ea95e69775df785728e3366; from c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 before 890d0312d5f94be43eac21f5a34d3bccc60d051b; from c14edb4d0bdc53f969ea84c7f384472c28b1a9f8 before c9d8e9adaa63150ef7e833480b799d0bab83a276; and 2 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de
https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca
https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07
https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6
https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf
https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366
https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b
https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.