Executive brief
A security vulnerability was identified in the Linux kernel's Industrial I/O (IIO) subsystem, which manages sensors and converters. A local user could potentially trigger a system crash or gain unauthorized access to memory by providing overly long input to specific debug interfaces. This could lead to a loss of system stability or the exposure of sensitive information.
Technical details
An out-of-bounds write vulnerability exists in 'drivers/iio/industrialio-core.c' within the 'iio_debugfs_write_reg' function. The issue stems from using 'count' (the user-provided length) to null-terminate a fixed-size stack buffer without verifying if 'count' exceeds the buffer's capacity. While 'simple_write_to_buffer' truncates the actual copy, the subsequent manual null-termination used the original 'count' value, leading to a memory corruption. A local attacker with access to the IIO debugfs interface can exploit this to crash the kernel or potentially achieve privilege escalation. The fix introduces a check against the buffer size and uses the return value of the copy function for correct termination.
Affected products
- Linux Linux Kernel 6.15 to 6.15.9, 6.16-rc1 to 6.16-rc6
Timeline
- 2025-08-22: disclosed
- 2025-08-22: advisory
- 2025-06-09: patched: Initial fix committed to mainline kernel tree