CVE-2026-64504

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: accel: bmc150: clamp the device-reported FIFO frame count<br /> <br /> __bmc150_accel_fifo_flush() copies the number of samples the device<br /> reports in its hardware FIFO into an on-stack buffer<br /> <br /> u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];<br /> <br /> which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The<br /> frame count is read from the FIFO_STATUS register and only masked to its<br /> 7 valid bits:<br /> <br /> count = val &amp; 0x7F;<br /> <br /> so it can be 0..127. The only other limit applied to it is the optional<br /> caller-supplied sample budget:<br /> <br /> if (samples &amp;&amp; count &gt; samples)<br /> count = samples;<br /> <br /> which does not constrain count on the flush-all path (samples == 0), and<br /> leaves it well above 32 whenever samples is larger. count samples are<br /> then transferred into buffer[]:<br /> <br /> bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);<br /> <br /> bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a<br /> malfunctioning, malicious or counterfeit accelerometer (or an attacker<br /> tampering with the I2C/SPI bus) that reports up to 127 frames writes up<br /> to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up<br /> to 570 bytes that clobbers the stack canary, saved registers and the<br /> return address.<br /> <br /> Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]<br /> is sized for, before the transfer, mirroring the watermark clamp already<br /> done in bmc150_accel_set_watermark(). A well-formed flush reports at most<br /> BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.