{"schema_version":"1.9.0","id":"CVE-2026-63934","published":"2026-07-19T14:55:32.681Z","modified":"2026-08-31T18:26:05.915336584Z","related":["SUSE-SU-2026:23066-1","SUSE-SU-2026:23068-1","SUSE-SU-2026:23193-1","SUSE-SU-2026:23194-1","SUSE-SU-2026:23221-1","SUSE-SU-2026:23231-1","SUSE-SU-2026:23237-1","SUSE-SU-2026:23241-1","SUSE-SU-2026:23244-1","SUSE-SU-2026:3790-1","SUSE-SU-2026:3810-1","openSUSE-SU-2026:21555-1"],"summary":"iio: gyro: itg3200: fix i2c read into the wrong stack location","details":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: itg3200: fix i2c read into the wrong stack location\n\nitg3200_read_all_channels() takes `__be16 *buf' as a parameter and\nfills the i2c_msg destination as `(char *)&buf'. Since `buf' is the\nparameter (a pointer), `&buf' is the address of the local pointer\nslot on the stack of itg3200_read_all_channels(), not the address\nof the caller's scan buffer. The (char *) cast hides the type\nmismatch.\n\ni2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)\n= 8 bytes into the parameter's stack slot, which is discarded when\nthe function returns. The caller's scan buffer in\nitg3200_trigger_handler() is never written to, so\niio_push_to_buffers_with_timestamp() pushes uninitialised stack\ncontents to userspace via /dev/iio:deviceX every scan -- both a\nfunctional bug (no actual gyroscope or temperature data is\ndelivered through the triggered buffer) and an information leak.\n\nThe non-buffered read_raw() path is unaffected: it goes through\nitg3200_read_reg_s16() which uses `&out' on a local s16 value,\nwhere that is correct.\n\nDrop the spurious `&' so the i2c read writes into the caller's\nbuffer.","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9dbf091da080508e9f632d307f357beb79a0766b"},{"fixed":"90e809376b0f0d1ddec2eec954aecdd2a5b40b0e"},{"fixed":"8654b5e2617819ff4f7c78071dfd0275e971a9b6"},{"fixed":"b64dd5f3b38911054cbcc570df617e3e8e75e562"},{"fixed":"31bbd4b87dd6701fa10e03ba7f6268e49e178d16"},{"fixed":"63203bd072b613c18c237b906b1c9d2dc4527337"},{"fixed":"15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1"},{"fixed":"cfc3283859cfdeacadf80d5e6880bdf871ffeaa6"},{"fixed":"6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63934.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"5.10.259"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.93"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.35"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.12"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63934.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/31bbd4b87dd6701fa10e03ba7f6268e49e178d16"},{"type":"WEB","url":"https://git.kernel.org/stable/c/63203bd072b613c18c237b906b1c9d2dc4527337"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8654b5e2617819ff4f7c78071dfd0275e971a9b6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/90e809376b0f0d1ddec2eec954aecdd2a5b40b0e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b64dd5f3b38911054cbcc570df617e3e8e75e562"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cfc3283859cfdeacadf80d5e6880bdf871ffeaa6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63934.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63934"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63934.json"}}