Memory Corruption in Broadcom Time-of-Flight Sensor Driver

CVE-2026-78116

What is CVE-2026-78116?

The Broadcom AFBR-S50 time-of-flight sensor driver contains a vulnerability that allows for double completion of a request when sensor data evaluation fails. This occurs in the data_ready_work_handler() function, where failure to evaluate sensor data leads to an erroneous finalization of the RTIO submission. Specifically, the function does not return after processing an error condition, resulting in a second completion that accesses freed memory. This behavior can cause memory corruption, including aliased submissions, writes to released buffers, and duplicate completions sent to applications. Attackers can exploit this through conditions that may be triggered transiently, such as harsh ambient light, making the impact substantial as it compromises device availability.

References