Bug 2516708 (CVE-2026-72479)

Summary:	CVE-2026-72479 kernel: iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's iio: accel: mma8452 module. When an I2C read operation fails, the mma8452_read() function incorrectly returns a success status. This can lead to the mma8452_read_raw() function using uninitialized stack memory, potentially resulting in information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:26:59 UTC

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: mma8452: handle I2C read error(s) in mma8452_read()

Currently, If i2c_smbus_read_i2c_block_data() fails but
mma8452_set_runtime_pm_state() succeeds, mma8452_read() returns 0.

As a result, the caller mma8452_read_raw() assumes the read was
successful and proceeds to use a buffer containing uninitialized
stack memory.

Add proper checking of the I2C read return value and propagate errors
to the caller.

Comment 1 Keith Grant 2026-08-19 18:09:37 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081536-CVE-2026-72479-5e38@gregkh/T