SB20260815237 - Use of Uninitialized Variable in Linux kernel iio magnetometer driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260815237

SB20260815237 - Use of Uninitialized Variable in Linux kernel iio magnetometer driver

Published: August 15, 2026

Security Bulletin ID SB20260815237
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of Uninitialized Variable (CVE-ID: CVE-2026-72481)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in the ak8975 magnetometer driver when processing i2c block read results that are shorter than the destination buffer. A local user can trigger the driver to forward partially uninitialized buffer contents to IIO buffers to disclose sensitive information.

The leaked data may be exposed from kernel stack memory to userspace.


Remediation

Install update from vendor's website.

References