The AK8975 magnetometer driver in the Linux kernel contains four code paths where the I2C read helper may return fewer bytes than requested. In those cases uninitialized stack bytes remain in the buffer and are later handed to the IIO subsystem, making them available to user‑space callers. The result is a potential information‑leak of kernel stack contents, which can compromise confidentiality of the host. The weakness aligns with CWE‑200 and CWE‑401.

Any Linux kernel that includes the AK8975 driver and does not yet incorporate the patch from commit 12848f4de (and other referenced commits) is affected. Affected releases span all kernel series that ship this driver prior to the fix. No specific vendor or version list is supplied in the CNA data.

The advisory lists a CVSS score of 5.5, indicating moderate severity. The EPSS score of <1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not included in CISA’s KEV catalog. The likely attack vector is local: a user with access to the IIO device or an attacker with kernel privileges could invoke the I2C read that returns fewer bytes than expected. Because the vulnerability only leaks uninitialized stack data to user‑space and requires local access, the overall risk remains moderate, but administrators should patch promptly.