CVE-2026-63936: iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
Published Jul 19, 2026
·
Updated
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: mt6359: fix unchecked return value in mt6358readimp
In mt6358readimp(), the variable valv is passed to regmapread()
but the return value is not checked. If the read fails, valv remains
uninitialized and its random stack content is subsequently reported
as a measurement result.
Initialize valv to zero to ensure a predictable value is reported
in case of bus failure and to prevent potential stack data leakage.
This also satisfies static analyzers that might otherwise flag the
variable as used uninitialized.
SecAlerts Pty Ltd. 132 Wickham Terrace Fortitude Valley, QLD 4006, Australia info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
What conditions are required for this issue to occur?
The affected mt6358_read_imp() path must encounter a regmap_read() failure. When that happens, the measurement result can be derived from uninitialized stack contents.
2
What is the practical impact of a failed read?
A bus-read failure can cause an unpredictable measurement value to be reported and may expose stack data through that result. The issue affects availability according to the supplied vector, with no listed confidentiality or integrity impact.
3
What can be done if the patch cannot be applied immediately?
The provided data does not identify a configuration workaround. Reducing or preventing bus-read failures in the affected path may reduce exposure, but applying the available patch is the documented remedy.