CVE-2025-39690
BaseFortify
Publication date: 2025-09-05
Last updated on: 2025-11-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-908 | The product uses or accesses a resource that has not been initialized. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves the iio accel sca3300 driver where uninitialized stack data could potentially be leaked to userspace. The issue was that the 'channels' array was not zeroed before use, which could expose sensitive or unintended data. The fix ensures that the 'channels' array is properly zeroed to prevent this leak.
How can this vulnerability impact me? :
The vulnerability could lead to unintended disclosure of uninitialized stack data to userspace, potentially exposing sensitive information or causing information leakage. This could be exploited by an attacker to gain access to data that should not be accessible.