CVE-2026-79978: Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
The RTIO streaming completion callback adxl345processfifosamplescb() in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report (readlen = MIN(fifobytes, bufavail)) to the space actually returned by rtiosqerxbuf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets from readbuf, bounded by the device-reported entry count rather than by the clamp. When the allocated buffer is smaller than a full batch, the driver writes up to 186 bytes past the end of the allocation; a companion defect left data->fifototalbytes un-reset at batch start, so an aborted or errored chain could leave a stale write offset that pushes the next batch's writes out of bounds as well.
A short buffer is an expected, first-class outcome of the RTIO allocator: rtioblockpoolalloc() walks the requested size down one block at a time until a contiguous run is available, and the driver only demands sizeof(struct adxl345fifodata) + 6 bytes as its minimum. Any streaming configuration whose mempool block granularity is smaller than a full FIFO batch (204 bytes) — for example the sensor shell's RTIODEFINEWITHMEMPOOL(sensorreadrtio, 8, 8, 32, 64, 4) used by sensor stream <dev> on fifowm incl, or the 16-byte-block streaming example in the documentation — takes this path whenever the pool is fragmented or the consuming thread falls behind.
The out-of-bounds writes are performed by the I2C/SPI RTIO backend (DMA on many SoCs) into the shared RTIO block pool, corrupting neighbouring live buffers or, for a pool smaller than one batch, memory beyond the pool itself. The written bytes are accelerometer samples and the destination follows the allocation, so there is no controllable corruption primitive: the realistic impact is silent corruption of other RTIO consumers' data or a crash. Reaching it requires a board with an interrupt-wired ADXL345 built with CONFIGADXL345STREAM, plus buffer-pool starvation, which a co-resident local workload can induce but which also occurs spontaneously under load; there is no network, USB or radio path to this code.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ADXL345 RTIO streaming are exposed when their RTIO mempool can return a buffer smaller than a full 204-byte FIFO batch. This includes configurations whose mempool block granularity is smaller than a full batch, because short allocations are an expected RTIO allocator outcome.
What conditions lead to an out-of-bounds write?
The write can occur when the allocated receive buffer is shorter than the data represented by the device-reported FIFO entry count, because reads are queued according to that count rather than the clamped available buffer length. An aborted or errored chain can also leave fifo_total_bytes at a stale offset, causing a subsequent batch to write beyond its allocation.
What level of attacker access is indicated?
The supplied vector rates the issue as local attackable, requiring low privileges and high attack complexity, with no user interaction. It indicates low integrity and availability impact and no confidentiality impact.
How can I assess whether a configuration is likely affected?
Verify whether the application uses the ADXL345 RTIO streaming path and examine its RTIO mempool behavior. A configuration is at risk if it can allocate less than 204 bytes for a FIFO batch while the driver can process the device-reported FIFO entry count.