---
id: "CVE-2026-79978"
kind: "vulnerability"
aliases: ["CVE-2026-79978"]
title: "Zephyr: ADXL345 FIFO streaming writes past RTIO buffer end"
severity: "low"
cvss: 3.6
epss: 0.00124
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["adxl345", "embedded", "rtio", "runtime", "sensors", "zephyr"]
not_affected_if: ["default-config", "large-rtio-blocks", "no-adxl345-streaming"]
published_at: "2026-10-23T20:17:27+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79978", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79978", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Zephyr: ADXL345 FIFO streaming writes past RTIO buffer end

The Zephyr ADXL345 accelerometer driver's streaming callback writes FIFO samples beyond the end of a too-small RTIO buffer when the pool is fragmented or starved. The out-of-bounds writes can corrupt neighbouring buffers or crash the system, but the attacker cannot control the written data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the board's Kconfig enables `CONFIG_ADXL345_STREAM` with an interrupt-wired ADXL345.
- Check the RTIO mempool block size used for streaming (for example `RTIO_DEFINE_WITH_MEMPOOL`) and whether it is smaller than a 204-byte FIFO batch.
- Check the Zephyr version in use against the fixed release.

## Fix

- Upgrade Zephyr to a release that includes the fix for this ADXL345 driver (fixed version: unknown from the sources).
- Until patched, avoid `CONFIG_ADXL345_STREAM` or use RTIO mempool blocks of at least 204 bytes.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79978
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79978

## From the sources

The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len = MIN(fifo_bytes, buf_avail)) to the space actually returned by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets from read_buf, bounded by the device-reported entry count rather than by the clamp. When the allocated buffer is smaller than a full batch, the driver writes up to 186 bytes past the end of the allocation; a companion defect left data->fifo_total_bytes un-reset at batch start, so an aborted or errored chain could leave a stale write offset that pushes the next batch's writes out of bounds as well.

A short buffer is an expected, first-class outcome of the RTIO allocator: rtio_block_pool_alloc() walks the requested size down one block at a time until a contiguous run is available, and the driver only demands sizeof(struct adxl345_fifo_data) + 6 bytes as its minimum. Any streaming configuration whose mempool block granularity is smaller than a full FIFO batch (204 bytes) — for example the sensor shell's RTIO_DEFINE_WITH_MEMPOOL(sensor_read_rtio, 8, 8, 32, 64, 4) used by sensor stream <dev> on fifo_wm incl, or the 16-byte-block streaming example in the documentation — takes this path whenever the pool is fragmented or the consuming thread falls behind.

The out-of-bounds writes are performed by the I2C/SPI RTIO backend (DMA on many SoCs) into the shared RTIO block pool, corrupting neighbouring live buffers or, for a pool smaller than one batch, memory beyond the pool itself. The written bytes are accelerometer samples and the destination follows the allocation, so there is no controllable corruption primitive: the realistic impact is silent corruption of other RTIO consumers' data or a crash. Reaching it requires a board with an interrupt-wired ADXL345 built with CONFIG_ADXL345_STREAM, plus buffer-pool starvation, which a co-resident local workload can induce but which also occurs spontaneously under load; there is no network, USB or radio path to this code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_