CVE-2026-63936: Linux Kernel Information Disclosure Bug

CVE-2026-63936 Overview

CVE-2026-63936 is a Linux kernel vulnerability in the Industrial I/O (IIO) analog-to-digital converter (ADC) driver for MediaTek MT6359 power management integrated circuits. The flaw resides in the mt6358_read_imp() function, which passes the local variable val_v to regmap_read() without checking the return value. When the register read fails, val_v remains uninitialized and its residual stack contents propagate as a valid measurement result. The issue is classified as an uninitialized memory use defect and can lead to stack data leakage through IIO channel reads.

Critical Impact
Failed register reads in the MT6359 ADC driver return uninitialized stack memory to user space, producing unreliable sensor data and enabling limited kernel stack information disclosure.

Affected Products

Linux kernel builds including the drivers/iio/adc/mt6359-auxadc (mt6358) driver
Devices using MediaTek MT6358 and MT6359 PMIC ADC channels
Stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-07-19 - CVE-2026-63936 published to the National Vulnerability Database
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63936

Vulnerability Analysis

The mt6358_read_imp() function in the MT6359 IIO ADC driver reads a voltage register through regmap_read() to compute an impedance measurement. The local variable val_v is passed by reference as the output buffer. The original code does not verify the return status of regmap_read(). On a bus failure or transient regmap error, val_v is never written, and the caller uses whatever content already occupied that stack slot.

The consequence is twofold. First, the driver returns non-deterministic measurement values to user space through the IIO sysfs interface. Second, the leaked contents originate from the kernel stack, which can contain remnants of prior function frames such as pointers, error codes, or partial data structures.

The upstream fix initializes val_v to zero, guaranteeing a predictable value if the read fails. This also satisfies static analyzers that would otherwise flag the variable as used-uninitialized [CWE-457].

Root Cause

The root cause is a missing error check on regmap_read() combined with an uninitialized local variable. The compiler is not obligated to zero automatic stack storage, so the value observed after a failed read is whatever the calling context left behind.

Attack Vector

Exploitation requires local access to a device that exposes the MT6359 ADC IIO channels. A user with permission to read the relevant IIO sysfs attributes can repeatedly trigger the code path under bus-error conditions and observe leaked stack bytes. Remote exploitation is not applicable. The primary impact is information disclosure and unreliable sensor telemetry, not code execution.

See the upstream commit references for the exact fix implementation: Kernel Git Commit Patch, Kernel Git Commit Fix, Kernel Git Commit Update, and Kernel Git Commit Change.

Detection Methods for CVE-2026-63936

Indicators of Compromise

Erratic or implausible impedance and voltage values returned from IIO channels backed by the MT6358/MT6359 ADC driver.
Kernel log entries showing regmap or SPMI bus errors on MediaTek PMIC devices without corresponding failure reporting from mt6358_read_imp().
Unprivileged processes repeatedly polling /sys/bus/iio/devices/iio:deviceN/in_* attributes tied to the MT6359 driver.

Detection Strategies

Inventory running kernel versions and compare against the fixed commits f9bbd943c34a, 944082fdb028, 6258bfec51e8, and a72f8e51d6ee to identify unpatched systems.
Enable KMSAN or KASAN in test builds to catch uninitialized reads originating from mt6358_read_imp().
Correlate userspace IIO reads with kernel regmap failure events using kernel tracing (ftrace, perf) on affected hardware.

Monitoring Recommendations

Monitor dmesg for repeated regmap read failures on MT6358/MT6359 PMIC channels.
Track unexpected values on downstream telemetry pipelines that consume MediaTek PMIC ADC readings.
Baseline expected IIO channel ranges and alert on measurements outside physically plausible bounds.

How to Mitigate CVE-2026-63936

Immediate Actions Required

Update to a Linux kernel build that includes the mt6358_read_imp initialization fix from the upstream stable trees.
Rebuild vendor kernels for MediaTek-based devices and redeploy through standard OTA or firmware update channels.
Restrict access to IIO sysfs attributes so that only trusted system services can read PMIC ADC values.

Patch Information

The fix initializes val_v to zero before calling regmap_read() and preserves the existing read logic. It is available in the following upstream commits: f9bbd943c34a, 944082fdb028, 6258bfec51e8, and a72f8e51d6ee. Downstream distributions and device vendors should backport these commits to any supported branch shipping the MT6359 auxadc driver.

Workarounds

Tighten filesystem permissions on /sys/bus/iio/devices/ entries associated with the MT6359 driver to limit unprivileged reads.
Disable the mt6359-auxadc module on systems that do not require MediaTek PMIC ADC telemetry, using modprobe blacklisting.
Apply the single-line initialization patch as an out-of-tree fix when a full kernel update is not immediately feasible.

bash

# Blacklist the affected module until a patched kernel is deployed
echo "blacklist mt6359-auxadc" | sudo tee /etc/modprobe.d/blacklist-mt6359.conf
sudo update-initramfs -u
sudo reboot