CVE-2026-78116

Name of the Vulnerable Software and Affected Versions Broadcom AFBR-S50 time-of-flight sensor driver (affected versions not specified)

Description An issue exists in the Broadcom AFBR-S50 time-of-flight sensor driver where an RTIO submission is completed twice when sensor data evaluation fails. In the data ready work handler() function, a non-STATUS OK return from Argus EvaluateData() triggers handle error on result(), which finalizes the request using rtio iodev sqe err(). However, the execution continues to the end of the function, finalizing the same rtio iodev sqe structure a second time via rtio iodev sqe ok() because the function fails to return after the error handler.

This double completion leads to the corruption of the RTIO submission pool and mempool bookkeeping. For streaming submissions, it results in writes through released buffers; for one-shot submissions, it causes duplicate pool entry frees and spurious success completions. This condition can be triggered by external factors such as harsh ambient light or SPI transfer errors, allowing an attacker to cause memory corruption and loss of availability on devices using the brcm,afbr-s50 driver without requiring physical contact or software access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.