Linux Kernel EUVD-2026-35432

Exploitation requires a Linux system running a kernel that has the drivers/greybus/gb-beagleplay driver loaded (effectively BeaglePlay or pin-compatible boards using greybus over a CC1352 radio coprocessor) and the attacker must be able to inject arbitrary bytes into the serdev channel that the driver's cc1352_bootloader_rx() callback consumes - typically via physical access to the on-board UART, a malicious or compromised CC1352 firmware image, or control of the bootloader handshake. The CVSS UI:R indicates the affected code path is reached during a bootloader interaction (the device must enter or be driven into the cc1352 bootloader receive flow), and AV:A reflects that the attack surface is the local serial link rather than a routable network, which sharply limits exposure on general-purpose servers and desktops that do not enable this driver.

The CVSS 3.1 base score of 8.0 (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects an adjacent-network vector with required user interaction and high impact across all three pillars, but the attack surface is narrow: the affected code path is the gb-beagleplay greybus driver communicating with a CC1352 coprocessor over serdev, which only matters on systems that load this driver (BeaglePlay boards and similar). EPSS is 0.02% (6th percentile) and the CVE is not on CISA KEV, which is consistent with a low-prevalence embedded/IoT kernel bug rather than a broadly exploitable server flaw. The CVSS AV:A is somewhat generous given the data source is a serdev UART link to a local radio MCU - in practice exploitation likely requires either physical/board-level access to inject malicious bootloader frames or compromise of the CC1352 firmware itself, which is closer to local than adjacent network. No POC is referenced and the only public artifacts are the upstream stable-tree fix commits; this is best treated as a routine kernel hardening fix to roll in with normal stable updates rather than an emergency patch.

An attacker who can drive the serdev stream feeding the CC1352 bootloader - for example by tampering with the on-board UART link on a BeaglePlay device, or by running malicious firmware on the CC1352 coprocessor - sends a sequence of serdev chunks crafted so that the next chunk plus any leftover bytes exceeds the size of rx_buffer. When cc1352_bootloader_rx() memcpy()s the chunk into the buffer without a bounds check, it overwrites adjacent kernel memory, which can be shaped to corrupt driver state or kernel structures and ultimately escalate to kernel code execution. No public exploit is identified at time of analysis.