Zephyr RTOS CVE-2026-19736

Requires all of: (1) an affected NXP SoC where the MCUX SDK compiles TRNG_SW_HEALTH_TESTS - MIMXRT595S, MIMXRT555S, MIMXRT533S, MIMXRT685S, or MIMXRT633S - with the TRNG as the zephyr,entropy chosen node; other SoCs take the clamping SDK path and are unaffected. (2) A request whose length is not a multiple of 4 bytes (e.g. 1), which is what causes the SDK's dataSize to underflow. For the syscall-driven privilege-boundary case: CONFIG_USERSPACE must be enabled and the unprivileged thread must have been granted the entropy device, after which it controls both destination address and length. The kernel-mode path (getentropy(), and sys_rand8_get()/sys_rand16_get() where sys_csrand_get()/sys_rand_get() resolve to the hardware generator) is reachable by any caller requesting a non-word-multiple length even without userspace. Limiting factors: local access only (no remote vector), the bug is absent on non-affected SoCs, and the overflow content is uncontrolled random data rather than attacker-chosen bytes.

The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-reachable, low-complexity flaw requiring low privileges, which matches the description: an unprivileged user-mode thread (PR:L) that has merely been granted the entropy device can trigger a deterministic out-of-bounds write of up to 127 bytes. Exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC indicated in the input, only a vendor patch and GHSA advisory; absence of these signals means this is a disclosed-and-patched issue rather than one under active exploitation. The high CVSS is driven by the escalation potential on MMU-less Cortex-M33 targets where user and kernel share one SRAM, so this is a genuine priority for anyone shipping the affected NXP parts with CONFIG_USERSPACE, but not an emergency 'patch-tonight' scenario in the absence of exploitation evidence. One signal to weigh independently: the input marks C:H (confidentiality High), yet the described primitive writes uncontrolled TRNG output and does not directly disclose data - confidentiality impact is at most opportunistic (secondary to a successful privilege escalation), so the real-world impact is weighted toward integrity and availability (corruption, crashes). No SSVC decision data was provided in the input to cross-reference.

On an affected NXP i.MX RT MCU running Zephyr with CONFIG_USERSPACE, an unprivileged application thread that has been granted access to the entropy device calls the entropy_get_entropy() syscall requesting a non-word-multiple length (e.g. 1 byte) at an attacker-chosen destination. The SDK's dataSize == 0 guard underflows and the generator writes up to 127 bytes of random data past the validated region into adjacent kernel SRAM, corrupting kernel bookkeeping such as object permission bitmaps and opening a path from crash to opportunistic privilege escalation. No public exploit code is identified at time of analysis.