The Linux kernel's bmc150 accelerometer driver (__bmc150_accel_fifo_flush function) copies the number of samples reported by the device's FIFO into a fixed-size on-stack buffer sized for 32 samples. The frame count is read from the FIFO_STATUS register and masked to 7 bits, allowing values up to 127. Without proper clamping, this count can exceed the buffer size, leading to a stack out-of-bounds write of up to 570 bytes when transferring data. This overflow can overwrite critical stack data such as the stack canary, saved registers, and return address. The vulnerability arises from insufficient validation of the frame count before the data transfer. The fix clamps the frame count to the buffer size (32 samples), preventing overflow. Legitimate devices do not report more than 32 frames, so normal operation is unaffected.

An attacker controlling a malfunctioning, malicious, or counterfeit accelerometer device, or able to tamper with the I2C/SPI bus, can cause a stack buffer overflow in the kernel driver. This overflow can overwrite critical stack data, potentially leading to kernel memory corruption and arbitrary code execution or system compromise. However, no known exploits in the wild have been reported.

A fix is available that clamps the device-reported FIFO frame count to the buffer size before data transfer, preventing the stack overflow. Users should apply the official Linux kernel update that includes this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or vendor patches for the exact fixed versions and apply them accordingly.