CVE-2026-64504

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack out-of-bounds write exists in the bmc150 accel fifo flush() function. The function copies a number of samples reported by the device hardware FIFO into an on-stack buffer buffer[] sized for 32 samples. Because the frame count is read from the FIFO STATUS register and only masked to 7 bits, it can reach a value of 127. When the samples variable is 0 or larger than 32, the bmc150 accel fifo transfer() function can write up to 762 bytes into the 192-byte buffer. This can be triggered by a malfunctioning, malicious, or counterfeit accelerometer, or an attacker tampering with the I2C/SPI bus, potentially clobbering the stack canary, saved registers, and the return address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.