CVE-2026-79978

Received Received - Intake

Buffer Overflow in Zephyr RTOS ADXL345 Driver

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: Zephyr Project

Description

The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len = MIN(fifo_bytes, buf_avail)) to the space actually returned by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets from read_buf, bounded by the device-reported entry count rather than by the clamp. When the allocated buffer is smaller than a full batch, the driver writes up to 186 bytes past the end of the allocation; a companion defect left data->fifo_total_bytes un-reset at batch start, so an aborted or errored chain could leave a stale write offset that pushes the next batch's writes out of bounds as well. A short buffer is an expected, first-class outcome of the RTIO allocator: rtio_block_pool_alloc() walks the requested size down one block at a time until a contiguous run is available, and the driver only demands sizeof(struct adxl345_fifo_data) + 6 bytes as its minimum. Any streaming configuration whose mempool block granularity is smaller than a full FIFO batch (204 bytes) — for example the sensor shell's RTIO_DEFINE_WITH_MEMPOOL(sensor_read_rtio, 8, 8, 32, 64, 4) used by sensor stream <dev> on fifo_wm incl, or the 16-byte-block streaming example in the documentation — takes this path whenever the pool is fragmented or the consuming thread falls behind. The out-of-bounds writes are performed by the I2C/SPI RTIO backend (DMA on many SoCs) into the shared RTIO block pool, corrupting neighbouring live buffers or, for a pool smaller than one batch, memory beyond the pool itself. The written bytes are accelerometer samples and the destination follows the allocation, so there is no controllable corruption primitive: the realistic impact is silent corruption of other RTIO consumers' data or a crash. Reaching it requires a board with an interrupt-wired ADXL345 built with CONFIG_ADXL345_STREAM, plus buffer-pool starvation, which a co-resident local workload can induce but which also occurs spontaneously under load; there is no network, USB or radio path to this code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-23

Last Modified

2026-10-23

Generated

2026-10-25

AI Q&A

2026-10-24

EPSS Evaluated

N/A

NVD

CVE-2026-79978

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a buffer overflow in the ADXL345 sensor driver for Zephyr RTOS. The driver incorrectly calculates the amount of data to read from the sensor's FIFO buffer, leading to writes beyond the allocated memory. This happens when the buffer pool is fragmented or too small, causing silent data corruption or crashes in other parts of the system.

Detection Guidance

This vulnerability is specific to systems running Zephyr RTOS with ADXL345 sensor streaming enabled and a fragmented memory pool. Detection requires checking for buffer overflows in RTIO block pool allocations during sensor streaming operations. No direct network detection commands are applicable as this is a local system issue.

Impact Analysis

The impact includes silent corruption of other RTIO consumers' data or system crashes. This occurs when the buffer pool is starved, which can happen under high system load or with specific memory configurations. The vulnerability requires a board with an interrupt-wired ADXL345 and the streaming feature enabled.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves memory corruption in a sensor driver (ADXL345) within the Zephyr RTOS. The impact is limited to data corruption or crashes in local RTIO consumers, with no evidence of data exfiltration or unauthorized access that would violate these standards.

Mitigation Strategies

Disable CONFIG_ADXL345_STREAM in your Zephyr RTOS configuration. Ensure RTIO block pool sizes are larger than the maximum FIFO batch size (204 bytes). Monitor memory pool fragmentation and increase block sizes if buffer starvation occurs under load.

Hi! I’m here to help you understand CVE-2026-79978. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70