Executive brief
A vulnerability in the Linux kernel's IMU sensor driver could allow a local user to access sensitive information from the system's memory. This occurs because certain internal data buffers are not properly cleared before being sent to user-accessible areas. While this does not allow an attacker to crash the system or take control, it could lead to the exposure of small amounts of kernel data.
Technical details
A stack information leak exists in the st_lsm6dsx IMU driver within the Linux kernel. The function `st_lsm6dsx_read_tagged_fifo` declares a buffer (`iio_buff`) on the stack with 8-byte alignment but fails to initialize it. Due to structural padding (a 'hole') between the sample data and the timestamp, uninitialized stack memory is copied to userspace when the buffer is processed. This vulnerability was introduced by an incomplete fix in a previous commit (c14edb4d0bdc) which addressed alignment but omitted initialization for the tagged path. The issue is resolved by zero-initializing the stack buffer.
Affected products
- Linux Linux Kernel 5.9.5 to 5.10
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf
- https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b
- https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07
- https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276
- https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6
- https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366
- https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca