Technical impact
The ADXL380 IIO driver incorrectly calculates how many entries to read from the device FIFO when multiple scan elements are enabled. Because the sensor supplies one sample at a time even with several channels active, the driver’s read count can exceed the real number of entries. If more data is fetched than exists, the driver can read invalid memory, potentially corrupting kernel buffers and triggering a crash or unstable behavior. The flaw is a classic buffer overread (CWE-805). The advisory does not describe a direct exploit, but the over‑read represents a serious kernel memory safety issue.
Affected Systems
All Linux kernel releases that contain the pre‑fixed ADXL380 driver are affected. The specific kernel versions are not listed, but any build with the driver before the commit that rounds the FIFO count to a multiple of enabled scan elements is vulnerable. Systems running that driver module without the patch are at risk.
Risk and Exploitability
The CVSS score is 7.8 and the EPSS probability is below 1%. The vulnerability is not listed in CISA KEV catalog. The attack vector can only be inferred as local or requiring physical access to the device: an attacker would need to trigger the sensor interrupt and cause the driver to read the FIFO. Even without a known exploit, the possibility of kernel memory corruption makes this a high‑risk issue that could lead to denial of service. The fix is to apply the kernel patch that ensures the read count is rounded down to a multiple of the enabled scan elements.
