Executive brief
A vulnerability was identified in the Linux kernel's driver for MPRLS0025PA pressure sensors. The issue involves improper initialization of internal data structures used during communication with the sensor. If exploited, this could lead to unpredictable system behavior or potential information leakage from the kernel's memory.
Technical details
A vulnerability exists in the mprls0025pa_spi driver within the Industrial I/O (IIO) subsystem of the Linux kernel. The function mpr_spi_xfer() declared a 'spi_transfer' structure on the stack without zero-initializing it. This can result in the SPI core processing a transfer with garbage values in uninitialized fields (such as delays, speed, or bits_per_word), which may lead to undefined behavior or the leakage of stack data to the SPI bus. The fix ensures the structure is zero-initialized before use. This issue was resolved in multiple stable branches of the Linux kernel in June 2026.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026-06-09
Timeline
- 2026-01-14: other: Patch authored
- 2026-06-09: disclosed: CVE published
- 2026-06-09: patched: Fixes integrated into stable branches