CVE-2026-72481 iio: magnetometer: ak8975: fix potential kernel stack memory leak
A local attacker can read uninitialized kernel stack memory via the AK8975 magnetometer driver, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72481?
CVE-2026-72481 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: magnetometer: ak8975: fix potential kernel stack memory leak
Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2c_smbus_read_i2c_block_data_or_emulated() returns a value less than the size of the buffer, uninitialized bytes are retained in the buffer and later the buffer is passed on to IIO buffers, potentially leaking memory to userspace.
Fix this by adding checks whether the return value of the function is equal to the size of the buffer and subsequently if the value is lesser than zero to distinguish from a returned error code.
Which versions are affected by CVE-2026-72481?
How do I fix CVE-2026-72481?
Apply the vendor's patch.
Is CVE-2026-72481 being exploited?
There is no known exploitation of CVE-2026-72481 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72481, DEBIAN-CVE-2026-72481, GHSA-278v-qwxj-mcm9, UBUNTU-CVE-2026-72481.