CVE-2026-64504 iio: accel: bmc150: clamp the device-reported FIFO frame count
A stack buffer overflow in the BMC150 accelerometer driver allows local attackers with physical access or bus control to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64504?
CVE-2026-64504 is a memory corruption vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: accel: bmc150: clamp the device-reported FIFO frame count
__bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer
u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];
which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits:
count = val & 0x7F;
so it can be 0..127. The only other limit applied to it is the optional caller-supplied sample budget:
if (samples && count > samples) count = samples;
which does not constrain count on the flush-all path (samples == 0), and leaves it well above 32 whenever samples is larger. count samples are then transferred into buffer[]:
bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);
bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a malfunctioning, malicious or counterfeit accelerometer (or an attacker tampering with the I2C/SPI bus) that reports up to 127 frames writes up to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up to 570 bytes that clobbers the stack canary, saved registers and the return address.
Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] is sized for, before the transfer, mirroring the watermark clamp already done in bmc150_accel_set_watermark(). A well-formed flush reports at most BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.
Which versions are affected by CVE-2026-64504?
How do I fix CVE-2026-64504?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64504 being exploited?
There is no known exploitation of CVE-2026-64504 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-64504, DEBIAN-CVE-2026-64504, GHSA-4j8x-6qx9-p4gc, ROOT-OS-UBUNTU-2204-CVE-2026-64504, UBUNTU-CVE-2026-64504.