{"apiVersion":"1.0","identifier":"CVE-2026-72396","description":"In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quoting Sashiko: This is a pre-existing issue, but I noticed that just before this block in adm1275_probe(), there might be an out-of-bounds stack read: ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, block_buffer); if (ret < 0) { ... } for (mid = adm1275_id; mid->name[0]; mid++) { if (!strncasecmp(mid->name, block_buffer, strlen(mid->name))) break; } Since i2c_smbus_read_block_data() reads up to 32 bytes into the uninitialized stack array block_buffer without appending a null terminator, strncasecmp() could read past the valid bytes returned in ret. For example, if the device returns a shorter string like -adm12-, checking it against -adm1275- up to the length of -adm1275- will continue reading into uninitialized stack bounds. Prevent reading uninitialized memory by zeroing the stack array.","publishedAt":"2026-08-15T06:22:13","lastModifiedAt":"2026-08-17T06:19:06","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72396","cvssScore":null,"cvssVector":"Pending","epssProbability":0.0022,"riskScore":0,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72396","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72396","en":"https://www.redsauce.net/en/cves/CVE-2026-72396","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72396","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72396","de":"https://www.redsauce.net/de/cves/CVE-2026-72396","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72396","el":"https://www.redsauce.net/el/cves/CVE-2026-72396"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72396"}}