CVE-2026-63965: Linux Kernel Information Disclosure Bug

CVE-2026-63965 Overview

CVE-2026-63965 is a kernel information disclosure vulnerability in the Linux iio (Industrial I/O) pressure subsystem, specifically in the BMP280/BMP580 barometric sensor driver. The bmp580_trigger_handler() function declares its scan buffer on the stack without an initializer, then copies 3 bytes of 24-bit sensor data into 4-byte __le32 fields. Because the channel storagebits value is 32, two bytes of uninitialized stack memory are pushed to userspace on every sensor scan. The issue is a regression introduced when the buffer was moved from private driver data to a stack-local structure, which dropped the implicit zeroing.

Critical Impact
Local users with access to the IIO buffer interface can read residual kernel stack bytes on each sensor read, potentially leaking sensitive kernel data such as pointers or secrets useful for further exploitation.

Affected Products

Linux kernel iio pressure driver bmp280 (BMP580 code path)
Kernel builds prior to the patched commits referenced below
Systems with a physical BMP580 pressure sensor exposed via IIO

Discovery Timeline

2026-07-19 - CVE-2026-63965 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63965

Vulnerability Analysis

The vulnerability is a classic uninitialized memory disclosure [CWE-908] in a Linux kernel IIO driver. The bmp580_trigger_handler() function services buffered sensor reads triggered by the IIO framework. On each invocation it allocates a scan buffer as a local struct on the kernel stack. The driver then executes memcpy() operations that transfer only 3 bytes of raw sensor output into each 4-byte __le32 channel slot, corresponding to the 24-bit compensated temperature (comp_temp) and compensated pressure (comp_press) values.

Because the surrounding storage is 32 bits per channel, the top byte of each field is never written by the driver. The IIO subsystem then delivers the full 4-byte channel word to userspace through the buffer character device or ring buffer. Two bytes of previously used kernel stack contents leak per scan sample, and the leak repeats for every trigger event. A local attacker with read access to the IIO device can harvest stack contents at high frequency to reconstruct pointers, canaries, or other in-kernel data.

Root Cause

The root cause is the removal of implicit zeroing when the scan buffer was refactored from driver private data into a stack-local structure. The sibling driver bme280_trigger_handler() received a matching fix earlier, but bmp580_trigger_handler() was overlooked because it exhibits a short-fill pattern rather than a padding-hole pattern. The upstream fix zero-initializes the on-stack structure so any bytes not written by the sensor path are guaranteed to be zero before the buffer is pushed to userspace.

Attack Vector

Exploitation requires local access to the target system and permission to open the IIO buffer device node associated with the BMP580 sensor. An attacker enables the buffer, configures the scan mask to include the affected pressure and temperature channels, and reads samples repeatedly. Each sample yields two bytes of leaked stack memory. Automated harvesting across many samples can reconstruct sensitive kernel state useful for defeating KASLR or building follow-on privilege escalation exploits. Remote exploitation is not applicable.

No verified public exploit code is available. The mechanism is described in the upstream commit messages referenced in the Kernel Git Commit Reference.

Detection Methods for CVE-2026-63965

Indicators of Compromise

Unexpected user-space processes opening /dev/iio:deviceN nodes associated with bmp280/bmp580 sensors
High-frequency reads from IIO buffer interfaces by non-sensor applications
Presence of unprivileged tools enumerating /sys/bus/iio/devices/ for pressure sensors

Detection Strategies

Audit installed kernel versions against the fixed commits 387c86b582e0, 58dfb6fe9dc8, and a58400f58f82 on git.kernel.org
Enable kernel auditing (auditd) rules on IIO character device access to flag anomalous readers
Correlate process telemetry with sensor buffer activity to identify non-legitimate consumers

Monitoring Recommendations

Track open() and read() syscalls targeting /dev/iio:device* and log the invoking UID and binary path
Monitor loading of the bmp280_* kernel modules on systems where the sensor is not expected
Alert on processes that read IIO buffers at sustained high sample rates outside of known sensor applications

How to Mitigate CVE-2026-63965

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commit a58400f58f82 and its backports
Rebuild and deploy vendor kernels that include the BMP580 trigger handler zero-initialization fix
Restrict access to IIO device nodes so only trusted sensor-service accounts can read them

Patch Information

The fix zero-initializes the on-stack scan structure in bmp580_trigger_handler() before any memcpy() operation, ensuring that the high bytes of comp_temp and comp_press are zero rather than residual stack data. The patch is available in the mainline and stable Linux trees at the following commit references: 387c86b582e0, 58dfb6fe9dc8, and a58400f58f82.

Workarounds

Unload the bmp280 kernel module on systems that do not require the sensor by running modprobe -r bmp280
Blacklist the driver with an entry in /etc/modprobe.d/ to prevent automatic loading at boot
Tighten permissions on /dev/iio:device* nodes via udev rules so only privileged services can read sensor buffers

bash

# Configuration example
# /etc/modprobe.d/blacklist-bmp280.conf
blacklist bmp280
blacklist bmp280_i2c
blacklist bmp280_spi

# /etc/udev/rules.d/90-iio-restrict.rules
SUBSYSTEM=="iio", KERNEL=="iio:device*", MODE="0600", OWNER="root", GROUP="root"