CVE-2026-43307 iio: accel: adxl380: Avoid reading more entries than present in FIFO
A logic error in the ADXL380 accelerometer driver can cause the kernel to read beyond FIFO bounds, potentially leading to a system crash or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43307?
CVE-2026-43307 is a high-severity denial of service vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: accel: adxl380: Avoid reading more entries than present in FIFO
The interrupt handler reads FIFO entries in batches of N samples, where N is the number of scan elements that have been enabled. However, the sensor fills the FIFO one sample at a time, even when more than one channel is enabled. Therefore,the number of entries reported by the FIFO status registers may not be a multiple of N; if this number is not a multiple, the number of entries read from the FIFO may exceed the number of entries actually present.
To fix the above issue, round down the number of FIFO entries read from the status registers so that it is always a multiple of N.
Which versions are affected by CVE-2026-43307?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43307?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43307 being exploited?
There is no known exploitation of CVE-2026-43307 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43307, DEBIAN-CVE-2026-43307, GHSA-q3cr-463h-3mvv, UBUNTU-CVE-2026-43307.