{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63967","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.024Z","datePublished":"2026-07-19T14:55:54.999Z","dateUpdated":"2026-07-19T14:55:54.999Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-07-19T14:55:54.999Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer\n\nThe tagged FIFO path declares iio_buff on the stack with __aligned(8)\nbut no initializer, but there is a hole in the structure, which will\nthen leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be\ncopied, but the space between that and the timestamp are not\ninitialized.\n\nCommit c14edb4d0bdc (\"iio:imu:st_lsm6dsx Fix alignment and data leak\nissues\") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan,\nbut for the tagged path it only added the alignment qualifier and not\nthe initializer :(\n\nFix this by just zero-initializing the structure on the stack."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"],"versions":[{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","lessThan":"ff8d3c088b77b11782f2c3b97e37425be050e8de","status":"affected","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","lessThan":"fe1a7f99e72ebd2880515332b79b8c256be22aca","status":"affected","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","lessThan":"babf1943a40bb5669db57d30ca16c22504b18e07","status":"affected","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","lessThan":"d42ac0bfb6a16617c62a59d53706579c7fadbfa6","status":"affected","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","lessThan":"3147b303b8c7d9f91da4b849ece33b45048f5eaf","status":"affected","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","lessThan":"e6bb3a49c5f9de870ea95e69775df785728e3366","status":"affected","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","lessThan":"890d0312d5f94be43eac21f5a34d3bccc60d051b","status":"affected","versionType":"git"},{"version":"c14edb4d0bdc53f969ea84c7f384472c28b1a9f8","lessThan":"c9d8e9adaa63150ef7e833480b799d0bab83a276","status":"affected","versionType":"git"},{"version":"a42ca3b182ccb766666a0be1053921cba190e2de","status":"affected","versionType":"git"},{"version":"5.9.5","lessThan":"5.10","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"],"versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","status":"unaffected","versionType":"semver"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"7.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9.5"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de"},{"url":"https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca"},{"url":"https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07"},{"url":"https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6"},{"url":"https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf"},{"url":"https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366"},{"url":"https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b"},{"url":"https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276"}],"title":"iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer","x_generator":{"engine":"bippy-1.2.0"}}}}