In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ti-ads8688: fix information leak in triggered buffer

The 'buffer' local array is used to push data to user space from a
triggered buffer, but it does not set values for inactive channels, as
it only uses iio_for_each_active_channel() to assign new values.

Initialize the array to zero before using it to avoid pushing
uninitialized information to userspace.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00051.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
26aa12ef64ee997d293659bbf645c6df99fb73e5 affected < 1c80a0985a9a14f33dbf63cd703ca010f094f878
c923e9effe50b0a83e74e1940afbecef5456bfda affected < 3bf8d1e87939b8a19c9b738564fddf5b73322f2f
61fa5dfa5f52806f5ce37a0ba5712c271eb22f98 affected < aae96738006840533cf147ffd5f41830987f21c5
61fa5dfa5f52806f5ce37a0ba5712c271eb22f98 affected < ebe2672bc42a0dfe31bb539f8ce79d024aa7e46d
61fa5dfa5f52806f5ce37a0ba5712c271eb22f98 affected < 455df95eb8f24a37abc549d6738fc8ee07eb623b
61fa5dfa5f52806f5ce37a0ba5712c271eb22f98 affected < 485570ed82b7a6bb109fa1d0a79998e21f7f4c73
61fa5dfa5f52806f5ce37a0ba5712c271eb22f98 affected < 2a7377ccfd940cd6e9201756aff1e7852c266e69
91664385e6c49f1e961e822f2d024776ac22102a affected —
a65024fc5754f2fca73541373a2502bef603565b affected —
3563bb70d6baa0a5e8082397e13f62f26053c04d affected —
Linux Linux affected
Version Status Constraints
5.14 affected —
0 unaffected < 5.14
5.4.290 unaffected ≤ 5.4.*
5.10.234 unaffected ≤ 5.10.*
5.15.177 unaffected ≤ 5.15.*
6.1.125 unaffected ≤ 6.1.*
6.6.72 unaffected ≤ 6.6.*
6.12.10 unaffected ≤ 6.12.*
6.13 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4075-1 linux security update
Debian DLA Debian DLA DLA-4076-1 linux-6.1 security update
EUVD EUVD EUVD-2024-53809 In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads8688: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.
Ubuntu USN Ubuntu USN USN-7379-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7379-2 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-7380-1 Linux kernel (Low Latency) vulnerabilities
Ubuntu USN Ubuntu USN USN-7381-1 Linux kernel (Low Latency) vulnerabilities
Ubuntu USN Ubuntu USN USN-7382-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-7387-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7387-2 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7387-3 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7388-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7389-1 Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN Ubuntu USN USN-7390-1 Linux kernel (Xilinx ZynqMP) vulnerabilities
Ubuntu USN Ubuntu USN USN-7391-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7392-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7392-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7392-3 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7392-4 Linux kernel (AWS FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7393-1 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7401-1 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7407-1 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-7413-1 Linux kernel (IoT) vulnerabilities
Ubuntu USN Ubuntu USN USN-7421-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7458-1 Linux kernel (IBM) vulnerabilities
Ubuntu USN Ubuntu USN USN-7459-1 Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN Ubuntu USN USN-7459-2 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-7463-1 Linux kernel (IBM) vulnerabilities
Ubuntu USN Ubuntu USN USN-7513-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7513-2 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7513-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7513-4 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-7513-5 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-7514-1 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-7515-1 Linux kernel (GKE) vulnerabilities
Ubuntu USN Ubuntu USN USN-7515-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7522-1 Linux kernel (Azure, N-Series) vulnerabilities
Ubuntu USN Ubuntu USN USN-7523-1 Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7524-1 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-7539-1 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-7540-1 Linux kernel (Raspberry Pi) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/1c80a0985a9a14f33dbf63cd703ca010f094f878 cve-icon cve-icon
https://git.kernel.org/stable/c/2a7377ccfd940cd6e9201756aff1e7852c266e69 cve-icon cve-icon
https://git.kernel.org/stable/c/3bf8d1e87939b8a19c9b738564fddf5b73322f2f cve-icon cve-icon
https://git.kernel.org/stable/c/455df95eb8f24a37abc549d6738fc8ee07eb623b cve-icon cve-icon
https://git.kernel.org/stable/c/485570ed82b7a6bb109fa1d0a79998e21f7f4c73 cve-icon cve-icon
https://git.kernel.org/stable/c/aae96738006840533cf147ffd5f41830987f21c5 cve-icon cve-icon
https://git.kernel.org/stable/c/ebe2672bc42a0dfe31bb539f8ce79d024aa7e46d cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html cve-icon
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html cve-icon
https://lore.kernel.org/linux-cve-announce/2025011937-CVE-2024-57906-6e61@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-57906 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-57906 cve-icon
History

Mon, 03 Nov 2025 21:30:00 +0000

Type Values Removed Values Added
References

Wed, 01 Oct 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Feb 2025 02:45:00 +0000

Type Values Removed Values Added
Metrics threat_severity

Low

 threat_severity

Important

Tue, 18 Feb 2025 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-908
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}

Sun, 02 Feb 2025 10:30:00 +0000

Type Values Removed Values Added
References

Thu, 23 Jan 2025 17:15:00 +0000

Type Values Removed Values Added
References

Mon, 20 Jan 2025 14:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Sun, 19 Jan 2025 12:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads8688: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.
Title iio: adc: ti-ads8688: fix information leak in triggered buffer
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-11-03T20:55:31.340Z

Reserved: 2025-01-19T11:50:08.372Z

Link: CVE-2024-57906

cve-icon Vulnrichment

Updated: 2025-11-03T20:55:31.340Z

cve-icon NVD

Status : Modified

Published: 2025-01-19T12:15:24.800

Modified: 2025-11-03T21:18:41.453

Link: CVE-2024-57906

cve-icon Redhat

Severity : Important

Publid Date: 2025-01-19T00:00:00Z

Links: CVE-2024-57906 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses