The Linux kernel iio core debugfs interface had a vulnerability where if the file position pointer (*ppos) was non-zero, simple_write_to_buffer() would not initialize the beginning of the buffer, leading to use of uninitialized data. Since non-zero *ppos values are unsupported, the fix involves checking *ppos at the start of the function and returning -EINVAL if it is non-zero, thereby preventing the uninitialized data usage.

The vulnerability could lead to uninitialized data being used in the kernel debugfs write operation for the iio core, which may cause undefined behavior or information leakage. However, since non-zero *ppos values are not supported and the function now returns an error in such cases, the impact is limited to improper usage scenarios.

A fix has been applied in the Linux kernel to check for non-zero *ppos values and return an error, preventing uninitialized data usage. Users should update to the fixed kernel version once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.