The BMC150 accelerometer driver in the Linux kernel incorrectly trusts a device‑reported FIFO frame count that may exceed the buffer size. The count is only masked to 7 bits (0–127) and, on a flush‑all operation, is not limited by any caller‑supplied budget, allowing an attacker funneled through a malicious or tampered I2C/SPI bus to cause a stack out‑of‑bounds write of up to 570 bytes. This overflow can overwrite the stack canary, saved registers, and return address, providing a straightforward path to arbitrary code execution if the driver runs in privileged kernel context.

All Linux kernel installations incorporating the BMC150 accelerometer driver are affected. The specific version range is not listed, but the vulnerability was present before the patch that clamps the frame count to the maximum buffer length of 32 samples. Users with newer kernels that include the fix are no longer vulnerable; however, any system still running an older kernel variant that has not applied this commit remains at risk.

The EPSS score indicates less than 1%, suggesting a low probability of real‑world exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the high severity of the stack corruption means that an attacker who can influence the FIFO count—such as through a compromised I2C host or malicious firmware—could trigger the overflow. Successful exploitation would grant kernel‑level code execution, effectively enabling full system compromise.