CVE-2026-63967

Last refreshed2026-10-30

Status: UPDATED | Advisory ID: CVE-2026-63967

Key Details

CVE	CVE-2026-63967
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-30
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-787 (Out-of-bounds Write)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer

The tagged FIFO path declares iio_buff on the stack with __aligned(8)

but no initializer, but there is a hole in the structure, which will

then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be

copied, but the space between that and the timestamp are not

initialized.

Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak

issues") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan,

but for the tagged path it only added the alignment qualifier and not

the initializer :(

Fix this by just zero-initializing the structure on the stack. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-63967
CVE	https://www.cve.org/CVERecord?id=CVE-2026-63967

Source

Reference

NVD

CVE