CVE-2026-64504 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems with the affected driver, as well as security teams and vulnerability management teams responsible for assessing and mitigating the risk of this vulnerability.

Why it matters

This vulnerability allows a malfunctioning or malicious device to write beyond the buffer's capacity, leading to a potential stack overflow. Linux kernel developers, maintainers, and users of Linux-based systems with the affected driver should assess exposure and prioritize remediation.

• Potential stack overflow and system crash
• Possible code execution or privilege escalation
• Denial of Service (DoS) due to system instability
• Data corruption or loss due to stack memory modification

Technical summary

The __bmc150_accel_fifo_flush() function in the Linux kernel's iio: accel: bmc150 driver does not properly clamp the device-reported FIFO frame count. This can lead to a stack out-of-bounds write of up to 570 bytes, potentially corrupting the stack canary, saved registers, and return address. The vulnerability is caused by a lack of proper clamping of the device-reported FIFO frame count, allowing a malfunctioning device to write beyond the buffer's capacity, leading to a potential stack overflow. The issue arises from the device-reported FIFO frame count not being properly clamped, allowing a malfunctioning device to write up to 570 bytes into a 192-byte buffer.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to address the vulnerability
• Restrict access to the affected systems and ensure that only authorized devices can interact with the I2C/SPI bus
• Monitor system logs for potential exploitation attempts
• Consider implementing additional security measures such as input validation and bounds checking
• Perform a thorough review of the system's inventory to identify potentially affected assets
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed

Evidence notes

The vulnerability is caused by a lack of proper clamping of the device-reported FIFO frame count in the __bmc150_accel_fifo_flush() function. This allows a malicious device to write beyond the buffer's capacity, leading to a potential stack overflow.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.