{"id":"CVE-2026-78116","revision":null,"records":[{"revision":"1634d52bef3a49fdafba0b998e1d93ef","observedAt":"2026-10-23T22:48:20.692+00:00","statement":{"source":"cve-program","id":"CVE-2026-78116","aliases":[],"title":"Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path","description":"The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers/sensor/broadcom/afbr_s50/afbr_s50.c), a non-STATUS_OK return from Argus_EvaluateData() calls handle_error_on_result(), which finalises the request with rtio_iodev_sqe_err(), but execution then fell through to the tail of the function and finalised the very same struct rtio_iodev_sqe a second time with rtio_iodev_sqe_ok(). Unlike the other error branches in the same function, this one did not return.\n\nBoth completion helpers reach rtio_executor_done() in subsys/rtio/rtio_executor.c, which returns the submission to the pool via rtio_sqe_pool_free() and, for streaming (multishot) submissions, also releases the RX buffer with rtio_release_buffer(). The second completion therefore reads a freed rtio_iodev_sqe, pushes the same mpsc node onto the submission queue while it is already on the pool free list — splicing the two lists together — and re-submits the freed request so the next measurement is written through an already-released buffer. For one-shot submissions it emits a spurious success completion carrying stale userdata and frees the same pool entry twice.\n\nThe failure branch is driven by sensor conditions rather than by host software. The vendor API documents statuses such as ERROR_ARGUS_BIAS_VOLTAGE_REINIT and ERROR_ARGUS_LASER_MONITOR_INACTIVE as transient results of harsh ambient light, so a party in front of the optical sensor can provoke the invalid-data condition without any physical contact with the board or any software access; SPI transfer errors reach the same branch. In releases before the payload.Status check was dropped, ordinary sharp distance transitions in the sensor's field of view were sufficient.\n\nImpact is corruption of the RTIO submission pool and mempool bookkeeping: aliased submissions, writes through released buffers, and duplicate completions delivered to the application. The attacker does not control the corrupted content, so the practical consequence is memory corruption and loss of availability on devices that instantiate brcm,afbr-s50, rather than directed code execution. Only builds that enable this driver are affected.","state":0,"publishedAt":"2026-10-21T18:19:28.872+00:00","modifiedAt":"2026-10-23T21:57:18.87+00:00","affected":[{"ecosystem":"https://github.com/zephyrproject-rtos/zephyr","name":"zephyr","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"zephyrproject\",\n                    \"product\": \"zephyr\",\n                    \"collectionURL\": \"https://github.com/zephyrproject-rtos/zephyr\",\n                    \"packageName\": \"zephyr\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"programFiles\": [\n                        \"drivers/sensor/broadcom/afbr_s50/afbr_s50.c\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"data_ready_work_handler\"\n                        }\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.3.0\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"4.5.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","score":5.2,"severity":"MEDIUM"}],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/817e92c5184c0d64b8cc6537f4e42ce1e5b635f9","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-559f-34rc-pgw2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-78116","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-78116","identifiers":["CVE-2026-78116"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T14:35:48.1677058+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T14:35:48.1677058+00:00","lastSuccessAt":"2026-10-26T14:35:48.3516958+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:48.3516975+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-c9e0dc0e630c65d3e2eec6bfd23be086a2f833dd3e7570a16b44670030aaf25b","complete":true,"records":414172,"lastAttemptAt":"2026-10-26T14:35:43.3458888+00:00","lastSuccessAt":"2026-10-26T14:35:43.2997194+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.3458888+00:00","snapshotPublishedAt":"2026-10-26T13:53:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T14:36:16.7068084+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4064,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T14:35:48.1677058+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T14:35:48.1677058+00:00","lastSuccessAt":"2026-10-26T14:35:48.3524508+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:48.3524813+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ddf1516e1d944b74b0e29872646a7464","complete":true,"records":13416,"lastAttemptAt":"2026-10-26T14:36:14.7824466+00:00","lastSuccessAt":"2026-10-26T14:36:14.779+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:36:14.779+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T14:35:43.7672517+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.7672517+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T14:35:43.5489133+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.5489133+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-26T14:35:48.1177056+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:48.1177056+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-690135177074a0c4b9ddcb48232cb870c32b1a7adcd972a81c224810b8437d0d","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T14:35:43.6565309+00:00","lastSuccessAt":"2026-10-26T12:37:54.7648812+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.6565309+00:00","snapshotPublishedAt":"2026-10-26T11:48:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}