CVE-2026-79978: bounds in zephyrproject zephyr

The vulnerability exists in the adxl345_process_fifo_samples_cb() callback in Zephyr's ADXL345 sensor driver. It clamps the reported FIFO data length to the buffer size but queues bus reads based on the device-reported FIFO entry count, leading to writes beyond the allocated buffer when the buffer is smaller than a full FIFO batch. Additionally, a related defect leaves stale write offsets that can cause subsequent batches to write out-of-bounds. The out-of-bounds writes occur in the I2C/SPI RTIO backend, corrupting adjacent buffers or memory beyond the pool. This requires an interrupt-wired ADXL345 with CONFIG_ADXL345_STREAM enabled and conditions causing buffer pool starvation. There is no network or external input vector to this code path.

The impact is limited to silent corruption of other RTIO consumers' data or potential crashes due to memory corruption. There is no confidentiality or availability impact beyond local denial of service or data integrity issues within the RTIO subsystem. Exploitation requires specific hardware and runtime conditions, making it unlikely in many deployments.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation involves ensuring the RTIO buffer pool is sufficiently sized to avoid buffer starvation and avoiding configurations where the pool block granularity is smaller than a full FIFO batch. Monitoring and adjusting workload to prevent buffer pool fragmentation may reduce risk.