Zephyr RTOS CVE-2026-19184

Privilege-boundary exploitation requires ALL of: a Zephyr build with CONFIG_USERSPACE=y; the target running on an NXP RW61x SoC with the GAU ADC device-tree node enabled; and an attacker-controlled user-mode thread that has already been granted the ADC device object. The attacker then calls the adc_read()/adc_read_async() syscalls supplying a deliberately undersized (roughly half-sized) sequence->buffer, and sets sequence->options->extra_samplings to walk the buffer pointer forward and extend the overrun up to the full supplied buffer size. Limiting factors: the vector is local only (no remote exposure), the attacker must already hold a device-object grant, and the vulnerable path does not exist on non-RW61x SoCs or on non-userspace builds - on those, the same bug is merely a silent overflow triggered only when the application itself passes an undersized buffer.

The CVSS 3.1 base score of 8.4 (vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) is driven by the changed scope (S:C) and high integrity/availability impact of crossing the userspace-to-kernel privilege boundary, not by remote reach - the attack vector is explicitly local (AV:L), so this is not a network-exposed flaw. Exploitation requires an already-present low-privileged user-mode thread (PR:L) that has been granted the ADC device object, which meaningfully narrows the real-world threat population. No EPSS score, SSVC decision data, or CISA KEV status was provided in the input, and no public exploit code is referenced - only the vendor patch commit and GHSA advisory - so there is no public exploit identified at time of analysis. Net assessment: this is a legitimate kernel memory-corruption / local privilege-escalation primitive worth patching on affected devices, but the local-only vector plus the narrow prerequisite (CONFIG_USERSPACE=y on NXP RW61x with the GAU ADC node) makes real-world urgency lower than the 8.4 headline suggests for the typical Zephyr deployment. Note: the KEV, EPSS, POC, and SSVC signals are all absent from the input and cannot be assumed - priority rests on the CVSS vector and the detailed root-cause description alone.

On a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC, a low-privileged user-mode thread that has been granted the ADC device object calls adc_read() with a buffer that is only half the size needed for the requested channels and extra_samplings. The syscall verifier confirms only that the thread owns the (undersized) writable bytes, so the supervisor-mode work-queue handler then writes 16-bit conversion results past the end of the buffer into adjacent kernel memory, enabling a crash or privilege escalation. No public proof-of-concept exploit is referenced in the available data.