CVE-2026-63934

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: gyro: itg3200: fix i2c read into the wrong stack location<br /> <br /> itg3200_read_all_channels() takes `__be16 *buf&amp;#39; as a parameter and<br /> fills the i2c_msg destination as `(char *)&amp;buf&amp;#39;. Since `buf&amp;#39; is the<br /> parameter (a pointer), `&amp;buf&amp;#39; is the address of the local pointer<br /> slot on the stack of itg3200_read_all_channels(), not the address<br /> of the caller&amp;#39;s scan buffer. The (char *) cast hides the type<br /> mismatch.<br /> <br /> i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)<br /> = 8 bytes into the parameter&amp;#39;s stack slot, which is discarded when<br /> the function returns. The caller&amp;#39;s scan buffer in<br /> itg3200_trigger_handler() is never written to, so<br /> iio_push_to_buffers_with_timestamp() pushes uninitialised stack<br /> contents to userspace via /dev/iio:deviceX every scan -- both a<br /> functional bug (no actual gyroscope or temperature data is<br /> delivered through the triggered buffer) and an information leak.<br /> <br /> The non-buffered read_raw() path is unaffected: it goes through<br /> itg3200_read_reg_s16() which uses `&amp;out&amp;#39; on a local s16 value,<br /> where that is correct.<br /> <br /> Drop the spurious `&amp;&amp;#39; so the i2c read writes into the caller&amp;#39;s<br /> buffer.