CVE-2026-63936

What it actually does

Unchecked return value from regmap_read() in mt6358_read_imp() leaves val_v uninitialized; its stack contents are subsequently returned as an ADC impedance measurement, enabling kernel stack data disclosure or reporting of garbage values on bus failure.

Why it matters to the business

Low-probability exposure of sensitive kernel memory through hardware sensor interfaces on affected MediaTek PMIC platforms; may complicate compliance or incident response if stack contents contain credentials or keys, though EPSS remains very low and no widespread exploitation is observed.

How an attack unfolds

An attacker with the ability to trigger mt6358_read_imp() under conditions that cause regmap_read() to fail (e.g., injected bus errors or resource contention) obtains the uninitialized stack value when the measurement result is later read by user-space or other kernel consumers.

How to fix it

Apply the upstream fix that initializes val_v to zero before the regmap_read() call; rebuild and deploy the updated kernel module for mt6359 ADC support. Where immediate patching is not possible, restrict access to the affected IIO ADC interfaces.

How to confirm the fix worked

Inspect the mt6358_read_imp() function in the running kernel source or binary to confirm val_v is explicitly initialized to zero prior to any use; verify that static analysis tools no longer flag the variable as potentially uninitialized.

Typical attack path

1. Obtain local execution context or hardware access sufficient to invoke the mt6359 ADC impedance read path
2. Force regmap_read() to fail while mt6358_read_imp() executes
3. Read the returned measurement value to harvest residual stack data
4. Parse leaked memory for useful artifacts such as pointers, credentials, or keys

How to detect it

Review kernel logs for regmap or IIO ADC errors around the time of suspicious measurement values; correlate unusual impedance readings with process activity that accesses the mt6359 ADC sysfs or character devices.

What your security team should do

• Prioritize kernel updates containing the mt6359 ADC fix on all systems using MediaTek PMICs
• Audit custom drivers or user-space code that consume mt6359 impedance readings for reliance on untrusted values
• Monitor EPSS and KEV status for any future increase in exploit maturity