Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-79978— Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 中，RTIO 流式传输完成回调函数 会将要报告的 FIFO 数据量限制为 实际返回的空间（即 ）。然而，随后该函数却依据设备报告的条目数量（而非上述限制值），从 开始，以连续偏移量对每个硬件 FIFO 条目发起一次 6 字节的总线读取。当已分配缓冲区小于完整批次大小时，驱动程序会向分配区域末尾之后最多 186 字节处写入数据。此外，还存在一个关联缺陷： 在批次开始时未被重置，因此若某条数据链被中止或出错，可能残留一个旧的写入偏移量，导致下一批次的写入同样越界。 短缓冲区是 RTIO 分配器的预期且一等公民式的结

CVSS 3.6 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-79978

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
Source: CVE Program / CVE List V5
Vulnerability Description
The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len = MIN(fifo_bytes, buf_avail)) to the space actually returned by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets from read_buf, bounded by the device-reported entry count rather than by the clamp. When the allocated buffer is smaller than a full batch, the driver writes up to 186 bytes past the end of the allocation; a companion defect left data->fifo_total_bytes un-reset at batch start, so an aborted or errored chain could leave a stale write offset that pushes the next batch's writes out of bounds as well. A short buffer is an expected, first-class outcome of the RTIO allocator: rtio_block_pool_alloc() walks the requested size down one block at a time until a contiguous run is available, and the driver only demands sizeof(struct adxl345_fifo_data) + 6 bytes as its minimum. Any streaming configuration whose mempool block granularity is smaller than a full FIFO batch (204 bytes) — for example the sensor shell's RTIO_DEFINE_WITH_MEMPOOL(sensor_read_rtio, 8, 8, 32, 64, 4) used by sensor stream <dev> on fifo_wm incl, or the 16-byte-block streaming example in the documentation — takes this path whenever the pool is fragmented or the consuming thread falls behind. The out-of-bounds writes are performed by the I2C/SPI RTIO backend (DMA on many SoCs) into the shared RTIO block pool, corrupting neighbouring live buffers or, for a pool smaller than one batch, memory beyond the pool itself. The written bytes are accelerometer samples and the destination follows the allocation, so there is no controllable corruption primitive: the realistic impact is silent corruption of other RTIO consumers' data or a crash. Reaching it requires a board with an interrupt-wired ADXL345 built with CONFIG_ADXL345_STREAM, plus buffer-pool starvation, which a co-resident local workload can induce but which also occurs spontaneously under load; there is no network, USB or radio path to this code.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.0.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-79978

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-79978

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-79978 (1)

Vendor Advisories for CVE-2026-79978 (1)

Same Patch Batch · zephyrproject · 2026-10-23 · 7 CVEs total

CVE-2026-79982 8.8 HIGH Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI
CVE-2026-79977 8.2 HIGH WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-pa
CVE-2026-79979 7.8 HIGH Stale TLB entries after demand-paging page-out let arm64 user threads access reused physic
CVE-2026-19741 7.5 HIGH OpenThread joiner autostart uses a publicly documented default Joining Device Credential (
CVE-2026-79981 6.5 MEDIUM DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoof
CVE-2026-79980 5.6 MEDIUM Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconf

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-787

V. Comments for CVE-2026-79978

No comments yet

Leave a comment