Zephyr RTOS CVE-2026-10644

Four specific conditions must all be satisfied simultaneously: (1) firmware must be compiled with CONFIG_UART_MCHP_ASYNC=y - this is explicitly not the default for in-tree PIC32CM-JH board configurations; (2) the application layer must call uart_rx_enable() with a receive buffer of exactly one byte (len == 1); (3) the attacker must have physical or logical serial line access to the target device's UART peripheral - network-remote exploitation is not possible; (4) a received byte must be pending in the SERCOM DATA register at the precise moment the RX-complete ISR fires, introducing a timing dependency that raises practical exploitation difficulty. What limits exploitation: non-default Kconfig requirement, narrow application coding pattern, physical/adjacent access requirement, single-byte fixed-location overwrite only (no control over write offset or size), and no confidentiality impact. Exploitation against default Zephyr PIC32CM-JH configurations is not possible.

The CVSS 3.1 score of 4.2 (Medium) with vector AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L accurately reflects the constrained real-world risk profile. The adjacent attack vector (AV:A) requires the attacker to be physically or logically connected to the target UART serial interface - eliminating remote internet-scale exploitation entirely. High attack complexity (AC:H) captures two compounding prerequisites: a non-default Kconfig option (CONFIG_UART_MCHP_ASYNC) and a specific application-level call pattern (1-byte receive buffer), plus timing dependency for the pre-buffered byte. Impact is bounded to a single fixed-location, fixed-size (one byte) write, with no confidentiality exposure. No EPSS data was provided in the intelligence feed; the vulnerability is absent from CISA KEV and no POC exists. For the vast majority of Zephyr deployments, this is a non-issue; risk is only relevant to firmware teams explicitly building PIC32CM-JH targets with async UART enabled and 1-byte buffer consumers.

An attacker with a serial connection to a PIC32CM-JH device running Zephyr firmware compiled with CONFIG_UART_MCHP_ASYNC enabled transmits a byte at the moment the firmware's RX path calls uart_rx_enable() with a 1-byte buffer, ensuring a byte is pending in the SERCOM DATA register when the RX-complete ISR fires. The DMA transfer then writes the attacker-supplied byte value to the memory location immediately following the receive buffer, corrupting adjacent memory. Depending on the firmware's memory layout, this could overwrite a stack variable, heap metadata, or a function pointer, most likely resulting in a crash, but potentially enabling further exploitation in specific memory arrangements. No public POC exists for this scenario.