CVE-2026-72396: hwmon: adm1275: Prevent reading uninitialized stack
In the Linux kernel, the following vulnerability has been resolved:
hwmon: adm1275: Prevent reading uninitialized stack
While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory.
Quoting Sashiko:
This is a pre-existing issue, but I noticed that just before this block in adm1275probe(), there might be an out-of-bounds stack read:
ret = i2csmbusreadblockdata(client, PMBUSMFRMODEL, blockbuffer); if (ret < 0) { ... } for (mid = adm1275id; mid->name[0]; mid++) { if (!strncasecmp(mid->name, blockbuffer, strlen(mid->name))) break; }
Since i2csmbusreadblockdata() reads up to 32 bytes into the uninitialized stack array blockbuffer without appending a null terminator, strncasecmp() could read past the valid bytes returned in ret.
For example, if the device returns a shorter string like "adm12", checking it against "adm1275" up to the length of "adm1275" will continue reading into uninitialized stack bounds.
Prevent reading uninitialized memory by zeroing the stack array.