Executive brief
A vulnerability in the Linux kernel's light sensor driver could allow a local user to access sensitive information from the system's memory. The issue occurs because the driver fails to clear internal memory buffers before passing them to user-accessible areas. This could potentially lead to the exposure of data from other processes or the kernel itself.
Technical details
An information disclosure vulnerability exists in the Linux kernel's IIO (Industrial I/O) subsystem, specifically within the as73211 light sensor driver. The 'as73211_trigger_handler' function fails to initialize the 'scan' structure, which contains padding or 'holes' between its members (the channel data and the timestamp). Because this uninitialized structure is copied into a kfifo that is readable by user space, a local attacker can read residual kernel memory contents. The fix involves properly zero-initializing the structure before use. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.10 to 5.10.241, 5.11 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4
Timeline
- 2025-08-02: patched: Initial patch authored by Jonathan Cameron
- 2025-09-05: disclosed: CVE published
References
- https://git.kernel.org/stable/c/433b99e922943efdfd62b9a8e3ad1604838181f2
- https://git.kernel.org/stable/c/83f14c4ca1ad78fcfb3e0de07d6d8a0c59550fc2
- https://git.kernel.org/stable/c/8acd9a0eaa8c9a28e385c0a6a56bb821cb549771
- https://git.kernel.org/stable/c/99b508340d0d1b9de0856c48c77898b14c0df7cf
- https://git.kernel.org/stable/c/cce55ca4e7a221d5eb2c0b757a868eacd6344e4a
- https://git.kernel.org/stable/c/d8c5d87a431596e0e02bd7fe3bff952b002a03bb
- https://git.kernel.org/stable/c/fd441fd972067f80861a0b66605c0febb0d038dd