Zephyr ADXL345 Driver EUVD-2026-109141

Requires a board with an interrupt-wired ADXL345 accelerometer, firmware built with CONFIG_ADXL345_STREAM, and an RTIO streaming configuration whose mempool block granularity is smaller than a full 204-byte FIFO batch - explicitly the sensor shell's RTIO_DEFINE_WITH_MEMPOOL(sensor_read_rtio, 8, 8, 32, 64, 4) (64-byte blocks) driven by 'sensor stream <dev> on fifo_wm incl', or the documented 16-byte-block streaming example. The out-of-bounds write is then triggered by RTIO block-pool starvation or fragmentation (the allocator returning a truncated buffer), which a co-resident local workload can induce and which also occurs spontaneously under load; a companion bug (fifo_total_bytes un-reset at batch start) can carry a stale offset after an aborted/errored chain. Limiting factors: strictly local - there is no network, USB or radio path; low local privileges are needed (PR:L); it is confined to specific ADXL345 streaming hardware/build configurations; and the corruption is uncontrollable (sample data at the allocation tail), so it yields no reliable exploitation primitive, only corruption or crashes.

All signals point to a low-priority, locally-scoped memory-safety defect. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L, base 3.6 Low) describes a local-only, high-complexity flaw requiring low privileges, with no confidentiality impact and only limited integrity/availability impact - and the description independently confirms there is 'no network, USB or radio path to this code.' The vuln.today Decision label is 'monitor,' the lowest urgency tier, which is consistent with the low CVSS. No EPSS score was supplied and the CVE is NOT in CISA KEV, so there is no exploitation-probability or active-exploitation signal; no PoC or exploit reference is present either, so this is no public exploit identified at time of analysis. The complexity driver (AC:H) is grounded in evidence: exploitation needs RTIO block-pool starvation/fragmentation, a condition a co-resident workload can induce but that also 'occurs spontaneously under load' - i.e. largely outside precise attacker control. Critically, the advisory states 'there is no controllable corruption primitive': the overwritten bytes are accelerometer samples written at the allocation's tail, so this cannot be steered into a reliable code-execution or privilege-escalation primitive; the realistic impact is silent corruption of other RTIO consumers' buffers or a crash. Net: a genuine out-of-bounds write (CWE-787) worth patching in affected embedded builds, but not an emergency - the low real-world risk is coherent across CVSS, the 'monitor' decision, absence of KEV/EPSS/PoC, and the uncontrollable nature of the corruption.

On a board with an interrupt-wired ADXL345 built with CONFIG_ADXL345_STREAM, a co-resident local workload (or ordinary load) starves/fragments the shared RTIO block pool so the allocator returns a buffer smaller than a full 204-byte FIFO batch. The driver still queues one 6-byte bus read per hardware FIFO entry, and the I2C/SPI RTIO backend (often DMA) writes up to 186 bytes past the allocation, corrupting neighbouring live buffers or memory beyond the pool and causing silent data corruption or a crash. No public exploit code is identified, and because the written bytes are just accelerometer samples at the tail of the allocation there is no controllable corruption primitive.