CVE-2026-72481

Received Received - Intake

Kernel Stack Memory Leak in AK8975 Magnetometer Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2c_smbus_read_i2c_block_data_or_emulated() returns a value less than the size of the buffer, uninitialized bytes are retained in the buffer and later the buffer is passed on to IIO buffers, potentially leaking memory to userspace. Fix this by adding checks whether the return value of the function is equal to the size of the buffer and subsequently if the value is lesser than zero to distinguish from a returned error code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72481

EUVD

EUVD-2026-59380

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a kernel stack memory leak in the Linux kernel's AK8975 magnetometer driver. It occurs when the i2c_smbus_read_i2c_block_data_or_emulated function returns a value smaller than the expected buffer size, leaving uninitialized memory in the buffer. This buffer is later passed to IIO buffers, potentially exposing sensitive kernel memory to userspace.

Detection Guidance

This vulnerability is specific to the Linux kernel's AK8975 magnetometer driver and involves potential kernel stack memory leaks. Detection requires checking the kernel version and the presence of the affected driver. Use commands like 'uname -a' to check kernel version and 'lsmod | grep ak8975' to see if the driver is loaded.

Impact Analysis

This vulnerability could allow an attacker with local access to read uninitialized kernel memory, potentially exposing sensitive information such as passwords, encryption keys, or other confidential data stored in memory.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations must address this to maintain regulatory compliance and protect user data.

Mitigation Strategies

Apply the latest kernel update or patch that includes the fix for this vulnerability. If using a custom kernel, ensure the AK8975 driver is updated to include the checks for return values to prevent memory leaks.

Hi! I’m here to help you understand CVE-2026-72481. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70