CVE-2026-63936 Details
Description
In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358_read_imp In mt6358_read_imp(), the variable val_v is passed to regmap_read() but the return value is not checked. If the read fails, val_v remains uninitialized and its random stack content is subsequently reported as a measurement result. Initialize val_v to zero to ensure a predictable value is reported in case of bus failure and to prevent potential stack data leakage. This also satisfies static analyzers that might otherwise flag the variable as used uninitialized.
A vulnerability exists in the Linux kernel's MediaTek MT6359 auxiliary ADC driver, specifically in the 'mt6358_read_imp()' function. The issue arises because the function reads a value into the variable 'val_v' using 'regmap_read()' without checking if the read operation was successful. If the read fails, 'val_v' remains uninitialized, and its random stack content is mistakenly reported as a measurement result. This flaw can lead to unintended data exposure. The vulnerability has been addressed by modifying the code to initialize 'val_v' to zero, ensuring that a predictable value is reported in the event of a bus failure. This change also prevents potential leakage of stack data and satisfies static analysis tools that may flag the variable as being used without initialization.
The vulnerability has been fixed in the Linux kernel stable tree. Users can upgrade to the latest version to address this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 19, 2026 | New CVE Received | kernel.org |