CVE-2026-46326: iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

Synopsis

An uninitialized-memory vulnerability affects the Linux kernel's IIO pressure sensor driver (mprls0025pa) for SPI-connected devices. The flaw is reachable locally, requires no authentication, and affects kernel versions prior to the fixed commits across the 6.12, 6.18, and 6.19 stable series. Successful exploitation gives an attacker full read, write, and crash capability over the affected kernel subsystem. Patched-image rebuilds at the fixed kernel versions (6.12.75, 6.18.14, 6.19.4) are available on HarborGuard for environments running an affected image.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationNot required

  No credentials or account privileges are needed to trigger the vulnerability.

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from another user or process.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• Reads sensitive kernel memory, which may expose cryptographic material, credentials, or other process data held in kernel space.
• Writes to kernel memory structures, enabling privilege escalation or arbitrary code execution within the kernel context.
• Crashes the affected kernel subsystem or the entire host, causing a full denial of service for all workloads on that node.
• Any container sharing the host kernel is exposed, meaning a compromise is not limited to a single workload or namespace.