The Linux kernel mma8452 driver contains a flaw where an I2C read failure is ignored if runtime power management succeeds. Consequently, mma8452_read() returns success, and the caller mma8452_read_raw() interprets the data as valid while actually using uninitialized stack memory. This can expose stale memory content, potentially leaking sensitive data or causing a crash. The weakness is an unchecked return value leading to use of uninitialized data (CWE‑824).

All Linux kernel builds that incorporate the mma8452 IIO driver without the recent fix are affected. The vulnerability impacts the Linux kernel’s accelerator driver for the mma8452 sensor, which is used in a variety of embedded devices such as smartphones, tablets, and IoT boards. No specific kernel version numbers are listed in the CNA data, so any kernel containing the unpatched mma8452 driver is vulnerable.

With a CVSS score of 5.5 and an EPSS rating of less than 1%, the vulnerability is considered medium severity and is currently not listed in the CISA KEV catalog. The flaw allows a local attacker with the ability to invoke the mma8452_read_raw() interface to gain information disclosure or cause a denial of service. The likely attack vector is via local use of the IIO subsystem; an adversary could trigger a failing I2C read by causing sensor reset or bad communication, resulting in the driver using garbage data. Because the vulnerability exists only in the kernel’s mma8452 driver, exploitation requires direct access to the I/O interface, making it a moderate risk in environments where the mma8452 sensor is exposed to untrusted users.