Description
The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers/sensor/broadcom/afbr_s50/afbr_s50.c), a non-STATUS_OK return from Argus_EvaluateData() calls handle_error_on_result(), which finalises the request with rtio_iodev_sqe_err(), but execution then fell through to the tail of the function and finalised the very same struct rtio_iodev_sqe a second time with rtio_iodev_sqe_ok(). Unlike the other error branches in the same function, this one did not return.

Both completion helpers reach rtio_executor_done() in subsys/rtio/rtio_executor.c, which returns the submission to the pool via rtio_sqe_pool_free() and, for streaming (multishot) submissions, also releases the RX buffer with rtio_release_buffer(). The second completion therefore reads a freed rtio_iodev_sqe, pushes the same mpsc node onto the submission queue while it is already on the pool free list — splicing the two lists together — and re-submits the freed request so the next measurement is written through an already-released buffer. For one-shot submissions it emits a spurious success completion carrying stale userdata and frees the same pool entry twice.

The failure branch is driven by sensor conditions rather than by host software. The vendor API documents statuses such as ERROR_ARGUS_BIAS_VOLTAGE_REINIT and ERROR_ARGUS_LASER_MONITOR_INACTIVE as transient results of harsh ambient light, so a party in front of the optical sensor can provoke the invalid-data condition without any physical contact with the board or any software access; SPI transfer errors reach the same branch. In releases before the payload.Status check was dropped, ordinary sharp distance transitions in the sensor's field of view were sufficient.

Impact is corruption of the RTIO submission pool and mempool bookkeeping: aliased submissions, writes through released buffers, and duplicate completions delivered to the application. The attacker does not control the corrupted content, so the practical consequence is memory corruption and loss of availability on devices that instantiate brcm,afbr-s50, rather than directed code execution. Only builds that enable this driver are affected.
Published: 2026-10-21
Score: 5.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption and Availability Loss
Action: Immediate Patch
AI Analysis

Impact

CWE‑415 double‑free occurs when the Broadcom AFBR‑S50 sensor driver processes a data‑ready event and the sensor evaluation fails. The failure path finalizes the same RTIO submission twice—once as an error, then as a success—causing the submission object to be returned to the pool, freed, and later used again. This results in stale data being written through a released buffer and duplicate completion callbacks being delivered to the application, effectively corrupting the RTIO pool bookkeeping and provoking memory corruption. The impact is loss of application availability and data integrity; there is no direct code‑execution path because the attacker cannot control the corrupted content. The flaw arises from a logic error in data_ready_work_handler() that omits a return statement after handling an error. As a result, the function falls through to the success code path, double‑finalizing the same RTIO object. The vulnerability is categorized as CWE‑415: Double Free.

Affected Systems

The affected product is the Broadcom AFBR‑S50 time‑of‑flight sensor driver compiled for the Zephyr RTOS (zephyrproject:zephyr). Any Zephyr build that enables this driver—the brcm,afbr‑S50 sensor module—is susceptible. No specific version range is listed, so all releases prior to the fixed commit are affected.

Risk and Exploitability

The CVSS score of 5.2 indicates moderate severity. The EPSS score is not available, but the lack of a KEV listing suggests that no public exploits are known. The likely attack vector is physical proximity to the sensor; a nearby party can induce sensor error conditions (harsh ambient light or SPI transfer errors) without having software access or physical contact with the board. Because the flaw merely corrupts memory and leads to denial of service, the threat is limited to availability disruption on the affected device.

Generated by OpenCVE AI on October 22, 2026 at 04:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Zephyr to a release that includes commit 817e92c5184c0d64b8cc6537f4e42ce1e5b635f9 or apply the patch cited in the GHSA‑559f‑34rc‑pgw2 advisory.
  • If an update is not feasible, disable the AFBR‑S50 sensor driver in the Zephyr configuration to eliminate the vulnerable code path.
  • Reduce the likelihood of sensor error conditions by controlling ambient lighting or ensuring stable SPI communication, thereby mitigating accidental triggers of the bug.

Generated by OpenCVE AI on October 22, 2026 at 04:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Wed, 21 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers/sensor/broadcom/afbr_s50/afbr_s50.c), a non-STATUS_OK return from Argus_EvaluateData() calls handle_error_on_result(), which finalises the request with rtio_iodev_sqe_err(), but execution then fell through to the tail of the function and finalised the very same struct rtio_iodev_sqe a second time with rtio_iodev_sqe_ok(). Unlike the other error branches in the same function, this one did not return. Both completion helpers reach rtio_executor_done() in subsys/rtio/rtio_executor.c, which returns the submission to the pool via rtio_sqe_pool_free() and, for streaming (multishot) submissions, also releases the RX buffer with rtio_release_buffer(). The second completion therefore reads a freed rtio_iodev_sqe, pushes the same mpsc node onto the submission queue while it is already on the pool free list — splicing the two lists together — and re-submits the freed request so the next measurement is written through an already-released buffer. For one-shot submissions it emits a spurious success completion carrying stale userdata and frees the same pool entry twice. The failure branch is driven by sensor conditions rather than by host software. The vendor API documents statuses such as ERROR_ARGUS_BIAS_VOLTAGE_REINIT and ERROR_ARGUS_LASER_MONITOR_INACTIVE as transient results of harsh ambient light, so a party in front of the optical sensor can provoke the invalid-data condition without any physical contact with the board or any software access; SPI transfer errors reach the same branch. In releases before the payload.Status check was dropped, ordinary sharp distance transitions in the sensor's field of view were sufficient. Impact is corruption of the RTIO submission pool and mempool bookkeeping: aliased submissions, writes through released buffers, and duplicate completions delivered to the application. The attacker does not control the corrupted content, so the practical consequence is memory corruption and loss of availability on devices that instantiate brcm,afbr-s50, rather than directed code execution. Only builds that enable this driver are affected.
Title Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path
Weaknesses CWE-415
References
Metrics cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-11-04T05:01:19.616Z

Reserved: 2026-08-22T20:22:57.556Z

Link: CVE-2026-78116

cve-icon Vulnrichment

Updated: 2026-10-23T20:42:53.115Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T19:17:03.517

Modified: 2026-11-04T05:19:02.177

Link: CVE-2026-78116

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:40:29Z

Weaknesses