The Linux kernel bmp280 pressure sensor driver contained a vulnerability (CVE-2026-63965) in the bmp580 trigger handler where a stack buffer was declared without initialization. The handler memcpy()s 3 bytes of 24-bit sensor data into a 4-byte __le32 field, leaving the high byte uninitialized. Because the channel storage bits are 32, this results in two bytes of uninitialized stack data being pushed to userspace per sensor scan. This regression occurred after moving the buffer from private data to a stack-local struct, which dropped the implicit zeroing. The fix involves zero-initializing the stack structure to prevent leakage of uninitialized stack memory.

Uninitialized stack memory is leaked to userspace during sensor data scans, potentially exposing sensitive kernel stack data. This could lead to information disclosure vulnerabilities. However, no known exploits are reported in the wild. The impact is limited to the bmp280 pressure sensor driver in the Linux kernel and involves leakage of two bytes of stack data per scan.

A fix is available that zero-initializes the stack structure in the bmp580 trigger handler to prevent uninitialized memory leakage. Users should update their Linux kernel to a version that includes this patch. Since this is a kernel driver issue, applying the official kernel update or patch from the Linux kernel maintainers is the recommended remediation. No additional mitigations are specified.