iio: accel: bmc150: clamp the device-reported FIFO frame count

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-64504
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-25 10:17:36 UTC
Updated2026-07-25 10:17:36 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits: count = val & 0x7F; so it can be 0..127. The only other limit applied to it is the optional caller-supplied sample budget: if (samples && count > samples) count = samples; which does not constrain count on the flush-all path (samples == 0), and leaves it well above 32 whenever samples is larger. count samples are then transferred into buffer[]: bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a malfunctioning, malicious or counterfeit accelerometer (or an attacker tampering with the I2C/SPI bus) that reports up to 127 frames writes up to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up to 570 bytes that clobbers the stack canary, saved registers and the return address. Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] is sized for, before the transfer, mirroring the watermark clamp already done in bmc150_accel_set_watermark(). A well-formed flush reports at most BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.

Risk And Classification

EPSS: 0.001650000 probability, percentile 0.061380000 (date 2026-07-29)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 3bbec9773389112330954a6a64422eaa78d546c1 b5a9f521e0a49a0266200fd535b32a9668ecb33b git Not specified
CNA Linux Linux affected 3bbec9773389112330954a6a64422eaa78d546c1 2fe0531dd73eff1de0f2584cb77716d645e548d5 git Not specified
CNA Linux Linux affected 3bbec9773389112330954a6a64422eaa78d546c1 d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff git Not specified
CNA Linux Linux affected 3bbec9773389112330954a6a64422eaa78d546c1 bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc git Not specified
CNA Linux Linux affected 3bbec9773389112330954a6a64422eaa78d546c1 89f4a4ca0ac3a933c750569a771c079a290b0721 git Not specified
CNA Linux Linux affected 3bbec9773389112330954a6a64422eaa78d546c1 3e766526827acd542bcd36c20c4d5f397e0f6521 git Not specified
CNA Linux Linux affected 3bbec9773389112330954a6a64422eaa78d546c1 35a3cd8fd65e15029eb90f1e510045b1bb071175 git Not specified
CNA Linux Linux affected 3bbec9773389112330954a6a64422eaa78d546c1 ce0e1cae26096fe959a0da5563a6d6d5a801d5fb git Not specified
CNA Linux Linux affected 4.1 Not specified
CNA Linux Linux unaffected 4.1 semver Not specified
CNA Linux Linux unaffected 5.10.261 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.212 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.96 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.39 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.4 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/b5a9f521e0a49a0266200fd535b32a9668ecb33b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/35a3cd8fd65e15029eb90f1e510045b1bb071175 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2fe0531dd73eff1de0f2584cb77716d645e548d5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/89f4a4ca0ac3a933c750569a771c079a290b0721 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3e766526827acd542bcd36c20c4d5f397e0f6521 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ce0e1cae26096fe959a0da5563a6d6d5a801d5fb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report