Skip to content
Heist/ feed
Low

Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path

Type: advisorySource: Official CVE List1 source record

The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len = MIN(fifo_bytes, buf_avail)) to the space actually returned by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets from read_buf, bounded by the device-reported entry count rather than by the clamp. When the allocated buffer is smaller than a full batch, the driver writes up to 186 bytes past the end of the allocation; a companion defect left data->fifo_total_bytes un-reset at batch start, so an aborted or errored chain could leave a stale write offset that pushes the next batch's writes out of bounds as well. A short buffer is an expected, first-class outcome of the RTIO allocator: rtio_block_pool_alloc() walks the requested size down one block at a time until a contiguous run is available, and the driver only demands sizeof(struct adxl345_fifo_data) + 6 bytes as its minimum. Any streaming configuration whose mempool block granularity is smaller than a full FIFO batch (204 bytes) — for example the sensor shell's RTIO_DEFINE_WITH_MEMPOOL(sensor_read_rtio, 8, 8, 32, 64, 4) used by sensor stream on fifo_wm incl, or the 16-byte-block streaming example in the documentation — takes this path whenever the pool is fragmented or the consuming thread falls behind. The out-of-bounds writes are performed by the I2C/SPI RTIO backend (DMA on many SoCs) into the shar

Announced Source revision 1
Original source ↗

CVE-2026-79978

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-79978

zephyr

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "zephyrproject",
    "product": "zephyr",
    "versions": [
      {
        "status": "affected",
        "version": "4.0.0",
        "versionType": "semver",
        "lessThanOrEqual": "4.4.2"
      }
    ],
    "packageName": "zephyr",
    "programFiles": [
      "drivers/sensor/adi/adxl345/adxl345_stream.c"
    ],
    "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "adxl345_process_fifo_samples_cb"
      }
    ]
  }
]
Related CVEs
CVE-2026-79978

Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event
#53178 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement