https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:50:53 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-19184 <p>The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence-&gt;buffer_size, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-&gt;results_length and used it in mcux_gau_adc_read_samples() as the number of uint16_t slots available. Because each conversion result occupies sizeof(uint16_t) bytes, a buffer that was accepted as &#34;large enough&#34; could be written with up to twice its size in bytes, so every sample past the buffer&#39;s midpoint was written out of bounds.</p> <p>adc_read() and adc_read_async() are Zephyr system calls. The syscall verifier in drivers/adc/adc_handlers.c only confirms that the caller owns buffer_size writable bytes (K_SYSCALL_MEMORY_WRITE); deciding whether that size is sufficient for the requested channels and extra_samplings is delegated entirely to the driver. On a build with CONFIG_USERSPACE=y, a user-mode thread that has been granted the ADC device object could therefore submit a deliberately half-sized buffer and cause the driver&#39;s work-queue handler — which runs in supervisor mode, outside the caller&#39;s MPU restrictions — to write ADC conversion results past the end of that buffer, at an address and for a length of the caller&#39;s choosing.</p> <p>The overrun is bounded by the requested sequence: with sequence-&gt;options-&gt;extra_samplings set, the sampling loop walks the buffer pointer forward across every sampling, so the total overrun can reach the…</p> <p>The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence-&gt;buffer_size, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-&gt;results_length and used it in mcux_gau_adc_read_samples() as the number of uint16_t slots available. Because each conversion result occupies sizeof(uint16_t) bytes, a buffer that was accepted as &#34;large enough&#34; could be written with up to twice its size in bytes, so every sample past the buffer&#39;s midpoint was written out of bounds.</p> <p>adc_read() and adc_read_async() are Zephyr system calls. The syscall verifier in drivers/adc/adc_handlers.c only confirms that the caller owns buffer_size writable bytes (K_SYSCALL_MEMORY_WRITE); deciding whether that size is sufficient for the requested channels and extra_samplings is delegated entirely to the driver. On a build with CONFIG_USERSPACE=y, a user-mode thread that has been granted the ADC device object could therefore submit a deliberately half-sized buffer and cause the driver&#39;s work-queue handler — which runs in supervisor mode, outside the caller&#39;s MPU restrictions — to write ADC conversion results past the end of that buffer, at an address and for a length of the caller&#39;s choosing.</p> <p>The overrun is bounded by the requested sequence: with sequence-&gt;options-&gt;extra_samplings set, the sampling loop walks the buffer pointer forward across every sampling, so the total overrun can reach the…</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-19184