The Linux kernel itg3200 gyroscope driver had a bug in the itg3200_read_all_channels() function where the i2c read operation wrote data into the local stack pointer slot instead of the caller's buffer. This happened because the function took a pointer parameter __be16 *buf but passed its address (&buf) to i2c_transfer(), causing the transfer to overwrite the local pointer variable rather than the intended buffer. Consequently, the caller's scan buffer remained uninitialized, and uninitialized stack contents were pushed to userspace via /dev/iio:deviceX on every scan, resulting in an information leak and loss of actual sensor data. The non-buffered read_raw() path was unaffected. The fix involved removing the erroneous address-of operator to ensure data is written into the correct buffer.

The vulnerability causes an information leak by exposing uninitialized stack memory to userspace through the triggered buffer interface. Additionally, it causes a functional failure where actual gyroscope and temperature data are not delivered to userspace via the triggered buffer. There is no indication of remote exploitability or privilege escalation. The non-buffered data read path remains unaffected.

A fix is available and has been applied to the Linux kernel source to correct the pointer usage in the itg3200 gyroscope driver. Users should update to a Linux kernel version that includes this fix. Since this is a kernel driver issue, applying the official kernel patch or upgrading to a fixed kernel version will remediate the vulnerability.