iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares iio_buff on the stack with __aligned(8) but no initializer, but there is a hole in the structure, which will then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be copied, but the space between that and the timestamp are not initialized. Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan, but for the tagged path it only added the alignment qualifier and not the initializer :( Fix this by just zero-initializing the structure on the stack.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.259, 5.15.210, 6.1.176, 6.12.93, 6.18.35, 6.6.143, 7.0.12
- CVEs
- CVE-2026-63967
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 08:57 UTC · Revision 1
Source evidence
iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
core-osv · Original sourcePublished 19 Jul 2026, 14:55 UTC
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares iio_buff on the stack with __aligned(8) but no initializer, but there is a hole in the structure, which will then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be copied, but the space between that and the timestamp are not initialized. Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan, but for the tagged path it only added the alignment qualifier and not the initializer :( Fix this by just zero-initializing the structure on the stack.
osv:CVE-2026-63967
Kernel
Fixed versions: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12
Complete source record
{
"id": "bb38c5c9fb050d2a9af4bd2aa9d4faa83d1b67df6a7047860a9609ecc79e4ef2",
"url": "https://osv.dev/vulnerability/CVE-2026-63967",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer",
"summary": "In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares iio_buff on the stack with __aligned(8) but no initializer, but there is a hole in the structure, which will then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be copied, but the space between that and the timestamp are not initialized. Commit c14edb4d0bdc (\"iio:imu:st_lsm6dsx Fix alignment and data leak issues\") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan, but for the tagged path it only added the alignment qualifier and not the initializer :( Fix this by just zero-initializing the structure on the stack.",
"evidence": "osv:CVE-2026-63967",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.259",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.210",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.176",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.143",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.93",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.35",
"evidence": "/affected/1/ranges"
},
{
"value": "7.0.12",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-63967",
"aliases": [
"CVE-2026-63967"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "c14edb4d0bdc53f969ea84c7f384472c28b1a9f8"
},
{
"fixed": "ff8d3c088b77b11782f2c3b97e37425be050e8de"
},
{
"fixed": "fe1a7f99e72ebd2880515332b79b8c256be22aca"
},
{
"fixed": "babf1943a40bb5669db57d30ca16c22504b18e07"
},
{
"fixed": "d42ac0bfb6a16617c62a59d53706579c7fadbfa6"
},
{
"fixed": "3147b303b8c7d9f91da4b849ece33b45048f5eaf"
},
{
"fixed": "e6bb3a49c5f9de870ea95e69775df785728e3366"
},
{
"fixed": "890d0312d5f94be43eac21f5a34d3bccc60d051b"
},
{
"fixed": "c9d8e9adaa63150ef7e833480b799d0bab83a276"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.9.5"
},
{
"fixed": "5.10"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a42ca3b182ccb766666a0be1053921cba190e2de"
}
]
}
],
"versions": [
"v5.9.16",
"v5.9.15",
"v5.9.14",
"v5.9.13",
"v5.9.12",
"v5.9.11",
"v5.9.10",
"v5.9.9",
"v5.9.8",
"v5.9.7",
"v5.9.6",
"v5.9.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63967.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.10.0"
},
{
"fixed": "5.10.259"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.210"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.176"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.143"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.93"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.35"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.0.12"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63967.json"
}
}
],
"modified": "2026-10-08T02:51:28.934497350Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf",
"https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b",
"https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07",
"https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276",
"https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6",
"https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366",
"https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca",
"https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63967.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-63967",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63967.json"
}
},
"related_cves": [
{
"value": "CVE-2026-63967",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 98314,
"published_at": "2026-07-19T14:55:54.999+00:00"
}