CVE-2026-78116: use-after-free in zephyrproject zephyr

The Broadcom AFBR-S50 sensor driver in Zephyr double-completes an RTIO submission when Argus_EvaluateData() returns an error. Specifically, in data_ready_work_handler(), a non-STATUS_OK return triggers handle_error_on_result() which finalizes the request with rtio_iodev_sqe_err(), but the function then continues and finalizes the same submission again with rtio_iodev_sqe_ok(). Both completions call rtio_executor_done(), which frees the submission back to the pool and releases buffers for streaming submissions. The second completion thus operates on freed memory, causing use-after-free conditions that corrupt the RTIO submission pool and mempool bookkeeping. This leads to aliased submissions, writes through released buffers, and duplicate completions. The error condition can be triggered by sensor conditions such as harsh ambient light or SPI transfer errors, without requiring software or physical access. The vulnerability impacts availability due to memory corruption but does not allow attacker-controlled code execution. Only builds enabling the brcm,afbr-s50 driver are affected.

The vulnerability causes memory corruption in the RTIO submission pool and mempool bookkeeping, resulting in aliased submissions, writes through freed buffers, and duplicate completions. This can lead to loss of availability or instability on devices using the affected driver. There is no direct confidentiality or integrity impact, and the attacker cannot control corrupted data to achieve code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling the Broadcom AFBR-S50 sensor driver (brcm,afbr-s50) in Zephyr builds if possible to prevent exposure. Monitor vendor communications for official patches or updates.