CVE-2026-72479

Received Received - Intake

Uninitialized Memory Read in Linux Kernel IIO MMA8452 Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Currently, If i2c_smbus_read_i2c_block_data() fails but mma8452_set_runtime_pm_state() succeeds, mma8452_read() returns 0. As a result, the caller mma8452_read_raw() assumes the read was successful and proceeds to use a buffer containing uninitialized stack memory. Add proper checking of the I2C read return value and propagate errors to the caller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72479

EUVD

EUVD-2026-59378

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's IIO accelerometer driver for the MMA8452 sensor. It occurs when an I2C read operation fails but the runtime power management state is set successfully. The function mma8452_read() incorrectly returns 0, leading the caller to use uninitialized stack memory, which could expose sensitive data or cause undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO accelerometer driver (mma8452) and does not have network-based detection methods. Detection requires checking the kernel version and the presence of the vulnerable driver code. Use commands like 'uname -a' to check kernel version and 'lsmod | grep mma8452' to verify if the driver is loaded.

Impact Analysis

This vulnerability could allow an attacker to read uninitialized memory from the kernel stack, potentially exposing sensitive information like passwords or encryption keys. It may also cause system instability or crashes if corrupted data is processed.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel driver issue involving uninitialized memory exposure due to I2C read failures, which could lead to information leaks but does not inherently violate regulatory requirements.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling the mma8452 driver if it is not required for your system.

Hi! I’m here to help you understand CVE-2026-72479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70