CVE-2024-57906: iio: adc: ti-ads8688: fix information leak in triggered buffer

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-19 · updated 2026-06-17
Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads8688: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.

Affected products

Linux kernel: from 4.19.198 before 4.20; from 5.4.132 before 5.5; from 5.10.50 before 5.11; from 5.12.17 before 5.13; from 5.13.2 before 6.1.125; from 6.2 before 6.6.72 — fixed in 4.20, 5.11, 5.13, 5.5, 6.1.125, 6.12.10

How to fix

Upgrade to a fixed version: Linux kernel 4.20, 5.11, 5.13, 5.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-57906 or the next vulnerability affects your stack