CVE-2026-63965
Received Received - Intake

Stack Leak in Linux Kernel IIO Pressure BMP280 Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix stack leak in bmp580 trigger handler bmp580_trigger_handler() declares its scan buffer on the stack without an initializer and then memcpy()s 3 bytes of 24-bit sensor data into each 4-byte __le32 field. The high byte of comp_temp and comp_press is left uninitialized, and the channel storagebits is 32, so two bytes of stack are pushed to userspace per scan. This is a regression from when the buffer lived in the private data, the move to a stack-local struct dropped the implicit zeroing. bme280_trigger_handler() was fixed up to handle this bug, but this driver was not fixed because there was no padding hole, but rather a short-fill issue. Fix this all by just zero-initializing the structure on the stack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63965
EUVD
EUVD-2026-45738

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the IIO pressure sensor driver for BMP280 devices. The bmp580_trigger_handler function uses a stack-allocated buffer without initialization. When copying 3-byte sensor data into 4-byte fields, the high byte remains uninitialized, leaking 2 bytes of stack memory to userspace per scan. This is a regression from a previous fix in bme280_trigger_handler.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO pressure sensor driver for BMP580 devices. Detection requires checking the kernel version and verifying if the vulnerable bmp580_trigger_handler() function is present in the compiled driver. No network detection commands are applicable.

Impact Analysis

This vulnerability could allow local users to read small amounts of uninitialized kernel stack memory. While not a direct privilege escalation, it may expose sensitive data or system information to userspace, potentially aiding further attacks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-risk stack leak in the Linux kernel's IIO pressure sensor driver, exposing uninitialized stack memory to userspace. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the kernel patch that zero-initializes the stack structure in bmp580_trigger_handler(). Update to a kernel version containing this fix. If immediate patching isn't possible, disable the BMP580 driver or restrict access to the affected device nodes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63965. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart