CVE-2026-64504

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: bmc150: clamp the device-reported FIFO frame count

__bmc150_accel_fifo_flush() copies the number of samples the device

reports in its hardware FIFO into an on-stack buffer

u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];

which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The

frame count is read from the FIFO_STATUS register and only masked to its

7 valid bits:

count = val & 0x7F;

so it can be 0..127. The only other limit applied to it is the optional

caller-supplied sample budget:

if (samples && count > samples)

count = samples;

which does not constrain count on the flush-all path (samples == 0), and

leaves it well above 32 whenever samples is larger. count samples are

then transferred into buffer[]:

bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);

bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a

malfunctioning, malicious or counterfeit accelerometer (or

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References