CVE-2026-63934
iio: gyro: itg3200: fix i2c read into the wrong stack location
Description
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200_read_all_channels() takes `__be16 *buf' as a parameter and fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the parameter (a pointer), `&buf' is the address of the local pointer slot on the stack of itg3200_read_all_channels(), not the address of the caller's scan buffer. The (char *) cast hides the type mismatch. i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16) = 8 bytes into the parameter's stack slot, which is discarded when the function returns. The caller's scan buffer in itg3200_trigger_handler() is never written to, so iio_push_to_buffers_with_timestamp() pushes uninitialised stack contents to userspace via /dev/iio:deviceX every scan -- both a functional bug (no actual gyroscope or temperature data is delivered through the triggered buffer) and an information leak. The non-buffered read_raw() path is unaffected: it goes through itg3200_read_reg_s16() which uses `&out' on a local s16 value, where that is correct. Drop the spurious `&' so the i2c read writes into the caller's buffer.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 27, 2026, 5:44 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Remove incorrect '&' in i2c read function calls.
- Ensure i2c reads target the caller's buffer correctly.
- Update the Linux kernel to the latest security patch.
- Verify gyroscope and temperature data is properly delivered.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63934.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63934 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63934
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63934 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63934 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '9dbf091da080508e9f632d307f357beb79a0766b', 'lessThan': '90e809376b0f0d1ddec2eec954aecdd2a5b40b0e', 'versionType': 'git'}, {'status': 'affected', 'version': '9dbf091da080508e9f632d307f357beb79a0766b', 'lessThan': '8654b5e2617819ff4f7c78071dfd0275e971a9b6', 'versionType': 'git'}, {'status': 'affected', 'version': '9dbf091da080508e9f632d307f357beb79a0766b', 'lessThan': 'b64dd5f3b38911054cbcc570df617e3e8e75e562', 'versionType': 'git'}, {'status': 'affected', 'version': '9dbf091da080508e9f632d307f357beb79a0766b', 'lessThan': '31bbd4b87dd6701fa10e03ba7f6268e49e178d16', 'versionType': 'git'}, {'status': 'affected', 'version': '9dbf091da080508e9f632d307f357beb79a0766b', 'lessThan': '63203bd072b613c18c237b906b1c9d2dc4527337', 'versionType': 'git'}, {'status': 'affected', 'version': '9dbf091da080508e9f632d307f357beb79a0766b', 'lessThan': '15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1', 'versionType': 'git'}, {'status': 'affected', 'version': '9dbf091da080508e9f632d307f357beb79a0766b', 'lessThan': 'cfc3283859cfdeacadf80d5e6880bdf871ffeaa6', 'versionType': 'git'}, {'status': 'affected', 'version': '9dbf091da080508e9f632d307f357beb79a0766b', 'lessThan': '6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae', 'versionType': 'git'}], 'programFiles': ['drivers/iio/gyro/itg3200_buffer.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/iio/gyro/itg3200_buffer.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200_read_all_channels() takes `__be16 *buf' as a parameter and fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the parameter (a pointer), `&buf' is the address of the local pointer slot on the stack of itg3200_read_all_channels(), not the address of the caller's scan buffer. The (char *) cast hides the type mismatch. i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16) = 8 bytes into the parameter's stack slot, which is discarded when the function returns. The caller's scan buffer in itg3200_trigger_handler() is never written to, so iio_push_to_buffers_with_timestamp() pushes uninitialised stack contents to userspace via /dev/iio:deviceX every scan -- both a functional bug (no actual gyroscope or temperature data is delivered through the triggered buffer) and an information leak. The non-buffered read_raw() path is unaffected: it goes through itg3200_read_reg_s16() which uses `&out' on a local s16 value, where that is correct. Drop the spurious `&' so the i2c read writes into the caller's buffer. Added Reference https://git.kernel.org/stable/c/15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1 Added Reference https://git.kernel.org/stable/c/31bbd4b87dd6701fa10e03ba7f6268e49e178d16 Added Reference https://git.kernel.org/stable/c/63203bd072b613c18c237b906b1c9d2dc4527337 Added Reference https://git.kernel.org/stable/c/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae Added Reference https://git.kernel.org/stable/c/8654b5e2617819ff4f7c78071dfd0275e971a9b6 Added Reference https://git.kernel.org/stable/c/90e809376b0f0d1ddec2eec954aecdd2a5b40b0e Added Reference https://git.kernel.org/stable/c/b64dd5f3b38911054cbcc570df617e3e8e75e562 Added Reference https://git.kernel.org/stable/c/cfc3283859cfdeacadf80d5e6880bdf871ffeaa6