Executive brief
A security vulnerability in the Linux kernel's driver for the ADIS16550 inertial measurement unit (IMU) could allow a local user to access sensitive information from the system's memory. The driver fails to properly clear internal memory before sending sensor data to applications, resulting in a small amount of kernel data being leaked. This could potentially expose fragments of system information that should remain private.
Technical details
A stack information leak exists in the adis16550_trigger_handler() function within drivers/iio/imu/adis16550.c. The scan data array is declared on the stack without initialization. While the driver populates sensor data and a timestamp, a 4-byte gap (bytes 28-31) between the sensor data and the 8-byte aligned timestamp remains uninitialized. This uninitialized kernel stack data is subsequently pushed to IIO buffers and leaked to userspace. The vulnerability is resolved by zero-initializing the data array on the stack.
Affected products
- Linux Linux Kernel 6.15 to 7.1
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory