CVE-2026-63967: Linux Kernel Information Disclosure Flaw

CVE-2026-63967 Overview

CVE-2026-63967 is a kernel information disclosure vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the st_lsm6dsx inertial measurement unit (IMU) driver. The tagged FIFO code path declares an iio_buff structure on the stack with an __aligned(8) qualifier but omits an initializer. Because the structure contains a hole between the sample data and the timestamp field, uninitialized stack memory leaks to userspace when ST_LSM6DSX_SAMPLE_SIZE (6 bytes) is copied. The issue was introduced when commit c14edb4d0bdc fixed the untagged FIFO path but overlooked the tagged path.

Critical Impact
Local userspace processes reading from the tagged FIFO of an st_lsm6dsx IMU device can obtain uninitialized kernel stack contents, potentially exposing pointers or sensitive kernel state usable for further exploitation.

Affected Products

Linux kernel builds enabling the iio: imu: st_lsm6dsx driver
STMicroelectronics LSM6DSx-family IMU sensors exposed through the IIO subsystem
Distributions shipping the affected kernel prior to the referenced stable-tree fixes

Discovery Timeline

2026-07-19 - CVE-2026-63967 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63967

Vulnerability Analysis

The defect resides in the tagged FIFO handling path of the st_lsm6dsx IIO driver. The driver allocates an iio_buff structure on the stack to stage a sample plus its timestamp before submitting it to the IIO core for delivery to userspace. The structure is aligned to 8 bytes to satisfy timestamp alignment requirements, but it is not zero-initialized. Structure padding between the 6-byte sample region and the 64-bit timestamp remains populated with whatever data was previously stored on the kernel stack.

When the driver copies ST_LSM6DSX_SAMPLE_SIZE bytes into the buffer and then hands the full record off, the intervening padding is transmitted alongside legitimate sensor telemetry. The category of weakness is uninitialized memory use leading to kernel information disclosure.

Root Cause

Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") migrated the untagged FIFO path to a kzalloc'd buffer stored in hw->scan, ensuring zero-initialization. The tagged path received only the alignment qualifier and no initializer. The corrective patch zero-initializes the on-stack structure so padding bytes do not carry residual kernel data.

Attack Vector

Exploitation requires local access to a system with an st_lsm6dsx device exposed through /dev/iio:deviceN or the sysfs buffer interface, and permission to read from the character device. An attacker reads sample records from the tagged FIFO and reconstructs the padding bytes across many samples to harvest residual kernel stack contents. The leaked bytes can include function return addresses, saved registers, or pointer values useful for bypassing Kernel Address Space Layout Randomization (KASLR).

No verified public exploit code is available. Refer to the upstream fix commits linked in the references for technical details on the affected code path.

Detection Methods for CVE-2026-63967

Indicators of Compromise

Unexpected user processes opening /dev/iio:deviceN associated with an lsm6ds* sensor on servers, laptops, or embedded devices without a legitimate telemetry consumer.
Sustained high-rate reads against IIO buffer sysfs entries (buffer/enable, buffer/length) from non-standard binaries.
Kernel builds reporting st_lsm6dsx module loaded with a version predating the referenced stable-tree commits.

Detection Strategies

Inventory kernel versions across the fleet and cross-reference against the fixed commits 3147b303, 890d0312, babf1943, c9d8e9ad, d42ac0bf, e6bb3a49, fe1a7f99, and ff8d3c08.
Audit which user accounts and containers hold read access to /dev/iio:device* nodes; treat unexpected access grants as suspicious.
Enable auditd rules on open and read syscalls targeting IIO device nodes to correlate access with process identity.

Monitoring Recommendations

Alert on non-service processes performing sustained reads from IIO character devices, particularly on multi-tenant hosts.
Track kernel module load events for st_lsm6dsx* and validate the running kernel package version matches the patched build.
Monitor SELinux or AppArmor denials involving iio_device_t labels to surface unauthorized access attempts.

How to Mitigate CVE-2026-63967

Immediate Actions Required

Apply the vendor kernel update that includes any of the referenced stable-tree commits fixing the tagged FIFO stack leak.
Restrict access to /dev/iio:device* nodes to trusted system services using group ownership or udev rules.
Remove or blacklist the st_lsm6dsx module on systems that do not require IMU functionality.

Patch Information

The fix zero-initializes the iio_buff structure on the stack in the tagged FIFO code path, ensuring padding bytes cannot leak kernel data. The patch is available across multiple stable branches via the kernel.org commits 3147b303, 890d0312, babf1943, c9d8e9ad, d42ac0bf, e6bb3a49, fe1a7f99, and ff8d3c08. Consume the update through your distribution's kernel package channel.

Workarounds

Unload the st_lsm6dsx module (modprobe -r st_lsm6dsx) on hosts where the sensor is not required.
Tighten permissions on IIO device nodes so only trusted daemons can open the tagged FIFO buffer.
Restrict container and sandbox access to /dev/iio:device* where full kernel upgrade cannot be scheduled immediately.

bash

# Configuration example: blacklist the driver and restrict device access
echo "blacklist st_lsm6dsx" | sudo tee /etc/modprobe.d/blacklist-st_lsm6dsx.conf
sudo modprobe -r st_lsm6dsx_i2c st_lsm6dsx_spi st_lsm6dsx 2>/dev/null

# udev rule to limit IIO device access to a trusted group
cat <<'EOF' | sudo tee /etc/udev/rules.d/90-iio-restrict.rules
SUBSYSTEM=="iio", KERNEL=="iio:device*", GROUP="iio-trusted", MODE="0640"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger