Skip to content
Heist/ feed
UnratedFix available

iio: accel: bmc150: clamp the device-reported FIFO frame count

Type: advisorySource: OSV1 source record

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits: count = val & 0x7F; so it can be 0..127. The only other limit applied to it is the optional caller-supplied sample budget: if (samples && count > samples) count = samples; which does not constrain count on the flush-all path (samples == 0), and leaves it well above 32 whenever samples is larger. count samples are then transferred into buffer[]: bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a malfunctioning, malicious or counterfeit accelerometer (or an attacker tampering with the I2C/SPI bus) that reports up to 127 frames writes up to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up to 570 bytes that clobbers the stack canary, saved registers and the return address. Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] is sized for, before the transfer, mirroring the watermark clamp already done in bmc150_accel_set_watermark(). A well-formed flush reports at most BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices

Announced Source revision 1
Original source ↗

CVE-2026-64504

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:CVE-2026-64504

Kernel

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
5.10.261

Source reference: /affected/1/ranges

5.15.212

Source reference: /affected/1/ranges

6.1.178

Source reference: /affected/1/ranges

6.6.145

Source reference: /affected/1/ranges

6.12.96

Source reference: /affected/1/ranges

6.18.39

Source reference: /affected/1/ranges

7.1.4

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
        "type": "GIT",
        "events": [
          {
            "introduced": "3bbec9773389112330954a6a64422eaa78d546c1"
          },
          {
            "fixed": "b5a9f521e0a49a0266200fd535b32a9668ecb33b"
          },
          {
            "fixed": "2fe0531dd73eff1de0f2584cb77716d645e548d5"
          },
          {
            "fixed": "d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff"
          },
          {
            "fixed": "bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc"
          },
          {
            "fixed": "89f4a4ca0ac3a933c750569a771c079a290b0721"
          },
          {
            "fixed": "3e766526827acd542bcd36c20c4d5f397e0f6521"
          },
          {
            "fixed": "35a3cd8fd65e15029eb90f1e510045b1bb071175"
          },
          {
            "fixed": "ce0e1cae26096fe959a0da5563a6d6d5a801d5fb"
          }
        ]
      }
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64504.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "4.1.0"
          },
          {
            "fixed": "5.10.261"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.11.0"
          },
          {
            "fixed": "5.15.212"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.16.0"
          },
          {
            "fixed": "6.1.178"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.2.0"
          },
          {
            "fixed": "6.6.145"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.7.0"
          },
          {
            "fixed": "6.12.96"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.13.0"
          },
          {
            "fixed": "6.18.39"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.19.0"
          },
          {
            "fixed": "7.1.4"
          }
        ]
      }
    ],
    "package": {
      "name": "Kernel",
      "ecosystem": "Linux"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64504.json"
    }
  }
]
Related CVEs
CVE-2026-64504

Source reference: /id

Publisher severity

No explicit severity was provided.

Event
#50794 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement