The ADXL345 driver in Zephyr's RTIO streaming path incorrectly clamps the FIFO read length but still queues bus reads based on the hardware FIFO count. When the allocated buffer is smaller than a full batch, the driver writes up to 186 bytes beyond the end of the allocation. Because the written data are accelerometer samples, there is no controllable corruption of arbitrary bytes; the effect is silent data corruption of neighboring RTIO buffers or a crash. This out‑of‑bounds write is a classic memory‑corruption flaw that can silently compromise the integrity of other RTIO consumers.

Any Zephyr‑based system that builds the ADXL345 driver with CONFIG_ADXL345_STREAM and uses the RTIO block pool allocator. The defect is triggered when the pool's block granularity is smaller than a full FIFO batch, for example with the sensor shell's RTIO_DEFINE_WITH_MEMPOOL(sensor_read_rtio, 8, 8, 32, 64, 4) or a 16‑byte block streaming example. Thus boards containing an ADXL345 sensor wired via interrupt and configured with the streaming mode are impacted.

The CVSS score of 3.6 classifies this as low severity. EPSS is unavailable and the vulnerability is not listed in CISA's KEV catalog. The attack vector is local to the device host; an attacker would need physical access or control of a local co‑resident workload that can induce RTIO block pool starvation or trigger the streaming path. Because the corrupted bytes are sensor samples, the exploit cannot write arbitrary data, reducing the likelihood of remote or malicious exploitation. Consequently the overall risk to the system is low, but the defect can quietly corrupt RTIO consumers or cause crashes under load.