« Volver al listado

CVE-2026-64504

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: bmc150: clamp the device-reported FIFO frame count

__bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer

which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits:

so it can be 0..127. The only other limit applied to it is the optional caller-supplied sample budget:

which does not constrain count on the flush-all path (samples == 0), and leaves it well above 32 whenever samples is larger. count samples are then transferred into buffer[]:

Leer descripción completaMostrar menos

bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a malfunctioning, malicious or counterfeit accelerometer (or an attacker tampering with the I2C/SPI bus) that reports up to 127 frames writes up to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up to 570 bytes that clobbers the stack canary, saved registers and the return address.

Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] is sized for, before the transfer, mirroring the watermark clamp already done in bmc150_accel_set_watermark(). A well-formed flush reports at most BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.

Detalles técnicos trazas, registros y código del informe original
	u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];

	count = val & 0x7F;

	if (samples && count > samples)
		count = samples;

	bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-64504",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "lessThan": "b5a9f521e0a49a0266200fd535b32a9668ecb33b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "lessThan": "2fe0531dd73eff1de0f2584cb77716d645e548d5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "lessThan": "d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "lessThan": "bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "lessThan": "89f4a4ca0ac3a933c750569a771c079a290b0721",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "lessThan": "3e766526827acd542bcd36c20c4d5f397e0f6521",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "lessThan": "35a3cd8fd65e15029eb90f1e510045b1bb071175",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "lessThan": "ce0e1cae26096fe959a0da5563a6d6d5a801d5fb",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/iio/accel/bmc150-accel-core.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/iio/accel/bmc150-accel-core.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-25T10:17:36.443",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2fe0531dd73eff1de0f2584cb77716d645e548d5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/35a3cd8fd65e15029eb90f1e510045b1bb071175",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3e766526827acd542bcd36c20c4d5f397e0f6521",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/89f4a4ca0ac3a933c750569a771c079a290b0721",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b5a9f521e0a49a0266200fd535b32a9668ecb33b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ce0e1cae26096fe959a0da5563a6d6d5a801d5fb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: bmc150: clamp the device-reported FIFO frame count\n\n__bmc150_accel_fifo_flush() copies the number of samples the device\nreports in its hardware FIFO into an on-stack buffer\n\n\tu16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];\n\nwhich is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The\nframe count is read from the FIFO_STATUS register and only masked to its\n7 valid bits:\n\n\tcount = val & 0x7F;\n\nso it can be 0..127. The only other limit applied to it is the optional\ncaller-supplied sample budget:\n\n\tif (samples && count > samples)\n\t\tcount = samples;\n\nwhich does not constrain count on the flush-all path (samples == 0), and\nleaves it well above 32 whenever samples is larger. count samples are\nthen transferred into buffer[]:\n\n\tbmc150_accel_fifo_transfer(data, (u8 *)buffer, count);\n\nbmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a\nmalfunctioning, malicious or counterfeit accelerometer (or an attacker\ntampering with the I2C/SPI bus) that reports up to 127 frames writes up\nto 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up\nto 570 bytes that clobbers the stack canary, saved registers and the\nreturn address.\n\nClamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]\nis sized for, before the transfer, mirroring the watermark clamp already\ndone in bmc150_accel_set_watermark(). A well-formed flush reports at most\nBMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected."
    }
  ],
  "lastModified": "2026-08-17T05:17:56.503",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}