Executive brief
The Linux kernel's Industrial I/O (IIO) subsystem contains a debugfs interface that could expose uninitialized buffer data when certain conditions are met. An attacker with local access to debugfs could potentially read sensitive kernel memory contents that were never properly initialized, potentially exposing configuration data or internal state information.
Technical details
The vulnerability exists in the `iio_debugfs_write_reg()` function in `drivers/iio/industrialio-core.c`. When a file position pointer (*ppos) is non-zero, the `simple_write_to_buffer()` helper function fails to initialize the start of the buffer, leaving uninitialized data accessible. The vulnerable code only validated the buffer size but not the file position. The fix adds a check to reject any write operations where *ppos is non-zero by returning -EINVAL, preventing use of the uninitialized path. This is a local information disclosure issue affecting systems with debugfs access enabled.
Affected products
- Linux Linux kernel Linux 4.0 through at least Linux 7.2
Timeline
- 2026-08-10: disclosed
- 2026-05-25: patched: Fix authored by Dan Carpenter