The ADIS16550 inertial‑measurement‑unit driver in the Linux kernel uses a 32‑byte stack array in its trigger handler without fully initializing it. The memcpy call copies only the first 28 bytes of sensor data, and a subsequent timestamp write writes to offset 32, leaving bytes 28‑31 uninitialized. These four bytes are copied into the buffer delivered to user space, leaking whatever data happened to reside on that stack region with each trigger. This uninitialized memory use allows a local user to read up to four bytes of potentially sensitive stack data in every sensor trigger, constituting an information‑disclosure flaw (CWE‑908).

Any Linux kernel build that includes the ADIS16550 IIO driver before the patch commit is vulnerable. Distributions shipping affected kernels for embedded or local platforms that expose the IIO device to user processes can be impacted.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a very low probability of exploitation. An attacker must have local read access to the ADIS16550 IIO device interface; remote exploitation is not feasible. Though only four bytes are leaked per trigger, repeated or malicious reads could accumulate sensitive stack information, raising the potential impact over time.