Linux Kernel Information Leak Vulnerability in IIO Light VCNL4035 Driver

A vulnerability has been identified in the Linux kernel's IIO light VCNL4035 driver, where the local 'buffer' array used to transfer data to userspace from a triggered buffer does not initialize its single data element, a u16 aligned to 8 bytes. This oversight leaves at least 4 bytes uninitialized, even after an integer value is read using regmap_read(). The vulnerability could lead to an information leak by sending uninitialized data to userspace. The issue has been addressed by initializing the array to zero before use.

Impact

Exploitation of this vulnerability could result in an information leak, allowing uninitialized data to be sent to userspace.