EUVD-2026-92285Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain user-mode thread with ADC device grant
-
DeliverySubmit half-sized buffer with extra_samplings set
-
ExploitSupervisor work-queue writes results past buffer end
-
ExecutionCorrupt adjacent kernel memory
-
ImpactEscalate to kernel or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Privilege-boundary exploitation requires ALL of: a Zephyr build with CONFIG_USERSPACE=y; the target running on an NXP RW61x SoC with the GAU ADC device-tree node enabled; and an attacker-controlled user-mode thread that has already been granted the ADC device object. The attacker then calls the adc_read()/adc_read_async() syscalls supplying a deliberately undersized (roughly half-sized) sequence->buffer, and sets sequence->options->extra_samplings to walk the buffer pointer forward and extend the overrun up to the full supplied buffer size. Limiting factors: the vector is local only (no remote exposure), the attacker must already hold a device-object grant, and the vulnerable path does not exist on non-RW61x SoCs or on non-userspace builds - on those, the same bug is merely a silent overflow triggered only when the application itself passes an undersized buffer. |
| Impact | The CVSS 3.1 base score of 8.4 (vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) is driven by the changed scope (S:C) and high integrity/availability impact of crossing the userspace-to-kernel privilege boundary, not by remote reach - the attack vector is explicitly local (AV:L), so this is not a network-exposed flaw. Exploitation requires an already-present low-privileged user-mode thread (PR:L) that has been granted the ADC device object, which meaningfully narrows the real-world threat population. No EPSS score, SSVC decision data, or CISA KEV status was provided in the input, and no public exploit code is referenced - only the vendor patch commit and GHSA advisory - so there is no public exploit identified at time of analysis. Net assessment: this is a legitimate kernel memory-corruption / local privilege-escalation primitive worth patching on affected devices, but the local-only vector plus the narrow prerequisite (CONFIG_USERSPACE=y on NXP RW61x with the GAU ADC node) makes real-world urgency lower than the 8.4 headline suggests for the typical Zephyr deployment. Note: the KEV, EPSS, POC, and SSVC signals are all absent from the input and cannot be assumed - priority rests on the CVSS vector and the detailed root-cause description alone. |
| Exploit ScenarioDerived | On a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC, a low-privileged user-mode thread that has been granted the ADC device object calls adc_read() with a buffer that is only half the size needed for the requested channels and extra_samplings. The syscall verifier confirms only that the thread owns the (undersized) writable bytes, so the supervisor-mode work-queue handler then writes 16-bit conversion results past the end of the buffer into adjacent kernel memory, enabling a crash or privilege escalation. No public proof-of-concept exploit is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Out-of-bounds kernel memory writes in the NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) of Zephyr RTOS let a local user-mode thread that has already been granted the ADC device object corrupt memory beyond an undersized buffer it supplies to the adc_read()/adc_read_async() syscalls. Exploitation of the privilege boundary requires a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC with the GAU ADC devicetree node enabled; the attack vector is localized (CVSS 3.1 8.4, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) and the caller must already hold a device-object grant, but the scope change (S:C) and high integrity/availability impact reflect a genuine userspace-to-kernel privilege escalation path capable of kernel memory corruption or a crash. No public exploit code and no confirmed active exploitation were identified at time of analysis; builds without CONFIG_USERSPACE or on SoCs other than RW61x with the GAU ADC node enabled are not exposed to the privilege boundary and only suffer a silent overflow when the application itself passes an undersized buffer.
RemediationAI
Apply the upstream fix (commit 82b11958065aa85f8644ddc318ff4a328d1443c8, referenced from advisory GHSA-j86w-mfgw-fxj9), which adopts the shared adc_sequence_validate_buffer() helper to check buffer_size against num_channels * sizeof(uint16_t), stores buffer_size / sizeof(uint16_t) in data->results_length, and repairs the loop bound to a post-decrement that writes exactly the available slots; upstream fix available (PR/commit); released patched version not independently confirmed, so backport or cherry-pick the change into the vendor SDK in use. Where the patch cannot be deployed immediately, the most direct mitigation on NXP RW61x is to stop granting the ADC device object to untrusted user-mode threads, which removes the attacker's ability to reach the vulnerable driver path at all; note this forfeits userspace access to the ADC for legitimate threads. Disabling the GAU ADC devicetree node on RW61x prevents the vulnerable code from being instantiated at the cost of losing ADC functionality on that peripheral, and building without CONFIG_USERSPACE eliminates the privilege boundary at the cost of application isolation across the whole image. On builds that are not userspace-enabled, the remaining risk is an application-level silent overflow, which should be avoided by validating buffer_size >= num_channels * sizeof(uint16_t) * (1 + extra_samplings) in application code before calling adc_read()/adc_read_async(). Because the flaw is local-only and requires an existing device-object grant, network-level controls are irrelevant; any interim hardening should focus on restricting which threads receive the ADC device object and on monitoring for kernel faults attributable to ADC work-queue activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a classic units/type confusion mapped to CWE-787 (Out-of-bounds Write). The caller-supplied adc_sequence.buffer_size is expressed in bytes, but mcux_gau_adc_do_read() compared it against num_channels, which is a sample count, and then stored the byte count verbatim into data->results_length. mcux_gau_adc_read_samples(), running as a work-queue handler in supervisor mode, treated results_length as the number of uint16_t slots available, so a buffer accepted as 'large enough' could be written with up to twice its byte size - every sample past the buffer's midpoint landing out of bounds. The Zephyr syscall verifier in drivers/adc/adc_handlers.c only asserts that the caller owns buffer_size writable bytes (K_SYSCALL_MEMORY_WRITE); judging adequacy for the requested channels and extra_samplings is delegated entirely to the driver, so an undersized buffer passes verification. With sequence->options->extra_samplings set, the sampling loop walks the buffer pointer forward across every sampling, extending the overrun to as much as the full supplied buffer size (kilobytes for large extra_samplings); the destination and length are fully attacker-controlled while the written 16-bit ADC conversion values are only partially influenced (via analog input, gain and resolution). Because the handler executes outside the caller's MPU restrictions, this is sufficient for kernel memory corruption, denial of service, or privilege escalation. The upstream fix replaces the ad-hoc size check with the shared adc_sequence_validate_buffer() helper validating against num_channels * sizeof(uint16_t), stores buffer_size / sizeof(uint16_t) in results_length, and corrects the loop bound to a post-decrement so exactly the available number of slots may be written.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Local syscall (AV:L) by a granted low-priv user thread (PR:L), reliably triggerable (AC:L), crossing the userspace-to-kernel boundary (S:C) to corrupt kernel memory (I:H/A:H) with no data disclosure (C:N).
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
DescriptionCVE.org
The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data->results_length and used it in mcux_gau_adc_read_samples() as the number of uint16_t slots available. Because each conversion result occupies sizeof(uint16_t) bytes, a buffer that was accepted as "large enough" could be written with up to twice its size in bytes, so every sample past the buffer's midpoint was written out of bounds.
adc_read() and adc_read_async() are Zephyr system calls. The syscall verifier in drivers/adc/adc_handlers.c only confirms that the caller owns buffer_size writable bytes (K_SYSCALL_MEMORY_WRITE); deciding whether that size is sufficient for the requested channels and extra_samplings is delegated entirely to the driver. On a build with CONFIG_USERSPACE=y, a user-mode thread that has been granted the ADC device object could therefore submit a deliberately half-sized buffer and cause the driver's work-queue handler - which runs in supervisor mode, outside the caller's MPU restrictions - to write ADC conversion results past the end of that buffer, at an address and for a length of the caller's choosing.
The overrun is bounded by the requested sequence: with sequence->options->extra_samplings set, the sampling loop walks the buffer pointer forward across every sampling, so the total overrun can reach the full size of the supplied buffer (kilobytes for a large extra_samplings). The written words are 16-bit ADC conversion results, so the content is only partially attacker-influenced (via the selected analog input, gain and resolution), but the destination and length are fully controlled - sufficient for kernel memory corruption, a crash, or a userspace-to-kernel privilege escalation. Builds without CONFIG_USERSPACE, or on SoCs other than NXP RW61x with the GAU ADC node enabled, are not exposed to the privilege boundary; there the same defect only causes a silent overflow when the application itself passes an undersized buffer.
The fix replaces the ad-hoc check with the shared adc_sequence_validate_buffer() helper (validating against num_channels * sizeof(uint16_t)), stores buffer_size / sizeof(uint16_t) in results_length, and corrects the loop bound to a post-decrement so exactly the available number of slots may be written.
Technical POC Analysis
CWE-787 (out-of-bounds write) in the NXP GAU ADC driver, drivers/adc/adcmcuxgauadc.c, function mcuxgauadcdoread().
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Zephyr RTOS deployments running on NXP RW61x systems-on-chip with the GAU ADC driver enabled and userspace isolation turned on are exposed to a kernel memory-corruption flaw that a local, already-privileged application thread can trigger through standard ADC read calls. Successful exploitation breaks the userspace-to-kernel boundary and can corrupt kernel memory or crash the device, threatening the integrity and availability of any affected product built on this configuration. Leadership should care because the exposure is limited to a specific silicon and build combination that is common in industrial, medical, and consumer edge devices, where a crash or memory compromise translates directly into field reliability, safety, and remediation cost.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB