Use of Uninitialized Variable in Linux kernel - CVE-2026-72481

Vulnerability identifier: #VU142956

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-72481

CWE-ID: CWE-457

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in the ak8975 magnetometer driver when processing i2c block read results that are shorter than the destination buffer. A local user can trigger the driver to forward partially uninitialized buffer contents to IIO buffers to disclose sensitive information.

The leaked data may be exposed from kernel stack memory to userspace.

Linux kernel
Ubuntu
linux-nvidia (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-azure (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1112.113, 5.15.0.1112.112
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux (Ubuntu package) - addressed in versions 7.0.0-38.38, 7.0.0-38.38.1, 7.0.0-1008.9, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14, 7.0.0-1015.15
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1015.15
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1017.17

• https://git.kernel.org/stable/c/12848f4ded022963944c063e09a192549a4dad1e
• https://git.kernel.org/stable/c/3d57672119525c59ed73ea21accb001ccbcd6cfd
• https://git.kernel.org/stable/c/8cf346074533356d67a6a6a43a192328ad341f11
• https://git.kernel.org/stable/c/9f920550abacedc7fc3163dea65ac2a7d0b0765d
• https://git.kernel.org/stable/c/a9a00d727b7bbc5e913a919530a9dd468935bf95
• https://git.kernel.org/stable/c/a9cf46054f81972f8c0f1dc2a79d2a141999dbce
• https://git.kernel.org/stable/c/b974566803bceb72f0b9b5f1d7270b79ba963766
• https://git.kernel.org/stable/c/fb27ebf81136e796c7b719303ef6fd7e1ae5d488

• Use of Uninitialized Variable in Linux kernel iio magnetometer driver
• Ubuntu update for linux-gcp-7.0
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-azure-7.0
• Ubuntu update for linux
• Ubuntu update for linux-azure
• Ubuntu update for linux-oem-7.0