VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 9, 2026

CVE-2026-46326

CVE-2026-46326

Description

Linux kernel iio: pressure: mprls0025pa driver has a vulnerability due to uninitialized spi_transfer struct.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Linux kernel iio: pressure: mprls0025pa driver has a vulnerability due to uninitialized spi_transfer struct.

Vulnerability

The Linux kernel's mprls0025pa driver, part of the iio: pressure subsystem, contains a vulnerability where the spi_transfer struct is not properly zeroed out before use. This affects versions of the kernel where this driver is present and this specific initialization issue exists.

Exploitation

An attacker would need to trigger the code path involving the uninitialized spi_transfer struct within the mprls0025pa driver. The exact conditions and steps required for exploitation are not detailed in the available references, but it likely involves interacting with the affected hardware or driver in a specific manner.

Impact

The impact of this vulnerability is not explicitly detailed in the provided references. However, issues with uninitialized structures in kernel drivers can potentially lead to information disclosure, denial of service, or, in some cases, privilege escalation depending on how the uninitialized data is interpreted or used.

Mitigation

This vulnerability has been resolved by ensuring the spi_transfer struct is zeroed out before use. The fix is available in the Linux kernel. Specific patched versions and release dates are not detailed in the provided references, but the commit reference [1] indicates a resolution.

References
  1. Making sure you're not a bot!

AI Insight generated on Jun 9, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

8
1e0ac56c92e2

iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitPetre RodanJan 14, 2026Fixed in 7.0via kernel-cna
commit
1 file changed · +1 −2
  • drivers/iio/pressure/mprls0025pa_spi.c+1 −2 modified
    diff --git a/drivers/iio/pressure/mprls0025pa_spi.c b/drivers/iio/pressure/mprls0025pa_spi.c
index d04102f8a4a03..e6bb75de34119 100644
--- a/drivers/iio/pressure/mprls0025pa_spi.c
+++ b/drivers/iio/pressure/mprls0025pa_spi.c
@@ -40,7 +40,7 @@ static int mpr_spi_xfer(struct mpr_data *data, const u8 cmd, const u8 pkt_len)
 {
 	struct spi_device *spi = to_spi_device(data->dev);
 	struct mpr_spi_buf *buf = spi_get_drvdata(spi);
-	struct spi_transfer xfer;
+	struct spi_transfer xfer = { };
 
 	if (pkt_len > MPR_MEASUREMENT_RD_SIZE)
 		return -EOVERFLOW;
-- 
cgit 1.3-korg
664ffdf34c01

iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitPetre RodanJan 14, 2026Fixed in 6.18.14via kernel-cna
commit
1 file changed · +1 −2
  • drivers/iio/pressure/mprls0025pa_spi.c+1 −2 modified
    diff --git a/drivers/iio/pressure/mprls0025pa_spi.c b/drivers/iio/pressure/mprls0025pa_spi.c
index d04102f8a4a03..e6bb75de34119 100644
--- a/drivers/iio/pressure/mprls0025pa_spi.c
+++ b/drivers/iio/pressure/mprls0025pa_spi.c
@@ -40,7 +40,7 @@ static int mpr_spi_xfer(struct mpr_data *data, const u8 cmd, const u8 pkt_len)
 {
 	struct spi_device *spi = to_spi_device(data->dev);
 	struct mpr_spi_buf *buf = spi_get_drvdata(spi);
-	struct spi_transfer xfer;
+	struct spi_transfer xfer = { };
 
 	if (pkt_len > MPR_MEASUREMENT_RD_SIZE)
 		return -EOVERFLOW;
-- 
cgit 1.3-korg
72158f9ae29a

iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitPetre RodanJan 14, 2026Fixed in 6.12.75via kernel-cna
commit
1 file changed · +1 −2
  • drivers/iio/pressure/mprls0025pa_spi.c+1 −2 modified
    diff --git a/drivers/iio/pressure/mprls0025pa_spi.c b/drivers/iio/pressure/mprls0025pa_spi.c
index 3aed14cd95c5a..f4807dac61e0f 100644
--- a/drivers/iio/pressure/mprls0025pa_spi.c
+++ b/drivers/iio/pressure/mprls0025pa_spi.c
@@ -40,7 +40,7 @@ static int mpr_spi_xfer(struct mpr_data *data, const u8 cmd, const u8 pkt_len)
 {
 	struct spi_device *spi = to_spi_device(data->dev);
 	struct mpr_spi_buf *buf = spi_get_drvdata(spi);
-	struct spi_transfer xfer;
+	struct spi_transfer xfer = { };
 
 	if (pkt_len > MPR_MEASUREMENT_RD_SIZE)
 		return -EOVERFLOW;
-- 
cgit 1.3-korg
9080c7ac30f5

iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitPetre RodanJan 14, 2026Fixed in 6.19.4via kernel-cna
commit
1 file changed · +1 −2
  • drivers/iio/pressure/mprls0025pa_spi.c+1 −2 modified
    diff --git a/drivers/iio/pressure/mprls0025pa_spi.c b/drivers/iio/pressure/mprls0025pa_spi.c
index d04102f8a4a03..e6bb75de34119 100644
--- a/drivers/iio/pressure/mprls0025pa_spi.c
+++ b/drivers/iio/pressure/mprls0025pa_spi.c
@@ -40,7 +40,7 @@ static int mpr_spi_xfer(struct mpr_data *data, const u8 cmd, const u8 pkt_len)
 {
 	struct spi_device *spi = to_spi_device(data->dev);
 	struct mpr_spi_buf *buf = spi_get_drvdata(spi);
-	struct spi_transfer xfer;
+	struct spi_transfer xfer = { };
 
 	if (pkt_len > MPR_MEASUREMENT_RD_SIZE)
 		return -EOVERFLOW;
-- 
cgit 1.3-korg
9080c7ac30f5

iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitPetre RodanJan 14, 2026via nvd-ref
commit
1 file changed · +1 −2
  • drivers/iio/pressure/mprls0025pa_spi.c+1 −2 modified
    diff --git a/drivers/iio/pressure/mprls0025pa_spi.c b/drivers/iio/pressure/mprls0025pa_spi.c
index d04102f8a4a03..e6bb75de34119 100644
--- a/drivers/iio/pressure/mprls0025pa_spi.c
+++ b/drivers/iio/pressure/mprls0025pa_spi.c
@@ -40,7 +40,7 @@ static int mpr_spi_xfer(struct mpr_data *data, const u8 cmd, const u8 pkt_len)
 {
 	struct spi_device *spi = to_spi_device(data->dev);
 	struct mpr_spi_buf *buf = spi_get_drvdata(spi);
-	struct spi_transfer xfer;
+	struct spi_transfer xfer = { };
 
 	if (pkt_len > MPR_MEASUREMENT_RD_SIZE)
 		return -EOVERFLOW;
-- 
cgit 1.3-korg
72158f9ae29a

iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitPetre RodanJan 14, 2026via nvd-ref
commit
1 file changed · +1 −2
  • drivers/iio/pressure/mprls0025pa_spi.c+1 −2 modified
    diff --git a/drivers/iio/pressure/mprls0025pa_spi.c b/drivers/iio/pressure/mprls0025pa_spi.c
index 3aed14cd95c5a..f4807dac61e0f 100644
--- a/drivers/iio/pressure/mprls0025pa_spi.c
+++ b/drivers/iio/pressure/mprls0025pa_spi.c
@@ -40,7 +40,7 @@ static int mpr_spi_xfer(struct mpr_data *data, const u8 cmd, const u8 pkt_len)
 {
 	struct spi_device *spi = to_spi_device(data->dev);
 	struct mpr_spi_buf *buf = spi_get_drvdata(spi);
-	struct spi_transfer xfer;
+	struct spi_transfer xfer = { };
 
 	if (pkt_len > MPR_MEASUREMENT_RD_SIZE)
 		return -EOVERFLOW;
-- 
cgit 1.3-korg
664ffdf34c01

iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitPetre RodanJan 14, 2026via nvd-ref
commit
1 file changed · +1 −2
  • drivers/iio/pressure/mprls0025pa_spi.c+1 −2 modified
    diff --git a/drivers/iio/pressure/mprls0025pa_spi.c b/drivers/iio/pressure/mprls0025pa_spi.c
index d04102f8a4a03..e6bb75de34119 100644
--- a/drivers/iio/pressure/mprls0025pa_spi.c
+++ b/drivers/iio/pressure/mprls0025pa_spi.c
@@ -40,7 +40,7 @@ static int mpr_spi_xfer(struct mpr_data *data, const u8 cmd, const u8 pkt_len)
 {
 	struct spi_device *spi = to_spi_device(data->dev);
 	struct mpr_spi_buf *buf = spi_get_drvdata(spi);
-	struct spi_transfer xfer;
+	struct spi_transfer xfer = { };
 
 	if (pkt_len > MPR_MEASUREMENT_RD_SIZE)
 		return -EOVERFLOW;
-- 
cgit 1.3-korg
1e0ac56c92e2

iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitPetre RodanJan 14, 2026via nvd-ref
commit
1 file changed · +1 −2
  • drivers/iio/pressure/mprls0025pa_spi.c+1 −2 modified
    diff --git a/drivers/iio/pressure/mprls0025pa_spi.c b/drivers/iio/pressure/mprls0025pa_spi.c
index d04102f8a4a03..e6bb75de34119 100644
--- a/drivers/iio/pressure/mprls0025pa_spi.c
+++ b/drivers/iio/pressure/mprls0025pa_spi.c
@@ -40,7 +40,7 @@ static int mpr_spi_xfer(struct mpr_data *data, const u8 cmd, const u8 pkt_len)
 {
 	struct spi_device *spi = to_spi_device(data->dev);
 	struct mpr_spi_buf *buf = spi_get_drvdata(spi);
-	struct spi_transfer xfer;
+	struct spi_transfer xfer = { };
 
 	if (pkt_len > MPR_MEASUREMENT_RD_SIZE)
 		return -EOVERFLOW;
-- 
cgit 1.3-korg

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

4

News mentions

1