The Linux kernel mma8452 driver contains a flaw where an I2C read failure is ignored if runtime power management succeeds. Consequently, mma8452_read() returns success, and the caller mma8452_read_raw() interprets the data as valid while actually using uninitialized stack memory. This can expose stale memory content, potentially leaking sensitive data or causing a crash. The weakness is an unchecked return value leading to use of uninitialized data (CWE‑252 and CWE‑457).

All Linux kernel builds that incorporate the mma8452 IIO driver without the recent fix are affected. The vulnerability impacts the Linux kernel’s acceler­ator driver for the mma8452 sensor, which is used in a variety of embedded devices such as smartphones, tablets, and IoT boards. No specific kernel version numbers are listed in the CNA data, so any kernel containing the unpatched mma8452 driver is vulnerable.

The CVSS and EPSS metrics are not supplied; however, the flaw can lead to information disclosure or denial of service for a local attacker with privileges to invoke the mma8452_read_raw() interface. The likely attack vector is through local use of the IIO subsystem; an adversary can trigger the failing I2C read by causing sensor reset or bad communication, resulting in use of garbage data. Because the vulnerability is only present in the kernel's device driver, exploitation requires the attacker to have access to the I/O interface, making it a moderate to high risk in environments where the mma8452 sensor is exposed to untrusted users.