CVE-2026-10644: Zephyr SERCOM-G1 UART Out-of-Bounds Write on PIC32CM-JH

Technical summary

The vulnerability resides in drivers/serial/uart_mchp_sercom_g1.c within the Zephyr RTOS kernel, affecting the PIC32CM-JH SoC family. When uart_rx_enable() is called with a one-byte receive buffer (len == 1) and CONFIG_UART_MCHP_ASYNC is enabled, a race condition occurs: the RX-complete ISR initiates a single-beat DMA transfer while a byte is already pending in the SERCOM DATA register. Due to the peripheral's DMA sequencing on this SoC, the DMA engine writes one byte past the allocated buffer boundary (CWE-787: Out-of-bounds Write). The overflowed byte's value is controlled by the UART data stream from the serial peer. The defect was introduced in Zephyr v4.4.0. The remediation reads the first byte via CPU and either skips DMA entirely for one-byte buffers or adjusts the DMA transfer size to len-1 for larger buffers.

Business impact

For organizations deploying Zephyr-based embedded systems on PIC32CM-JH hardware with asynchronous UART receive enabled, this flaw introduces a denial-of-service and data integrity risk. A local attacker on the serial line can trigger memory corruption that may crash the device or cause unpredictable behavior. Most in-tree reference designs do not enable this configuration by default, so impact is limited to custom implementations that explicitly configure async UART with minimal buffers. The risk is elevated in unattended or safety-critical embedded deployments where device restarts are costly or where adjacent memory corruption could trigger cascading failures.

Affected systems

The Zephyr RTOS project is affected, specifically the SERCOM-G1 UART driver component. Impact is restricted to: (1) Zephyr v4.4.0 and later, (2) PIC32CM-JH SoC family microcontrollers, (3) systems with CONFIG_UART_MCHP_ASYNC enabled, and (4) applications calling uart_rx_enable() with single-byte receive buffers. In-tree reference board configurations do not enable async UART by default, so custom firmware builds with this specific configuration combination are the primary attack surface.

Exploitability

Exploitability is moderate and heavily dependent on application design. An attacker requires: (1) physical or logical access to the UART serial interface, (2) knowledge that the target firmware uses async UART with one-byte buffers (not easily discoverable), and (3) ability to send arbitrary data over the UART. No authentication or elevated privileges are needed. The flaw is not a remote code execution vector; it enables only single-byte memory corruption adjacent to the RX buffer, with impact ranging from no observable effect to denial of service depending on what memory occupies that location. Exploitation is not automated or generally applicable across Zephyr deployments without detailed knowledge of the target's UART configuration.

Remediation

The fix (merged in Zephyr following publication) modifies the RX path to read the first pending byte using the CPU rather than relying on DMA for one-byte buffers. For larger buffers, the DMA transfer is sized to len-1 bytes to prevent overrun. This eliminates the race condition and out-of-bounds write. Organizations should upgrade to the patched Zephyr release; verify against the Zephyr project security advisories for the exact version containing the fix. If immediate patching is not feasible, disable CONFIG_UART_MCHP_ASYNC on affected boards or ensure that uart_rx_enable() is never called with buffers smaller than two bytes.

Patch guidance

Apply the latest Zephyr kernel update that includes the SERCOM-G1 UART fix. Consult the Zephyr project's official release notes and security advisories to identify the patched version. Organizations using Zephyr in production should establish a testing environment to validate the patch against their specific board configuration and UART usage patterns before deploying to devices. If the patch introduces any regression in UART performance or behavior on your platform, report it to the Zephyr security team. For organizations unable to patch immediately, the mitigation is to disable async UART mode (CONFIG_UART_MCHP_ASYNC = n) or refactor code to use buffers larger than one byte.

Detection guidance

Detection of active exploitation is challenging because the vulnerability produces only a single-byte memory corruption. Monitor for unexpected device resets, memory faults, or data corruption logs on PIC32CM-JH-based systems running async UART. Firmware analysis tools can scan Zephyr binaries for uart_rx_enable() calls with hardcoded one-byte buffer sizes to identify at-risk deployments. Enable memory protection or sanitizers (if available on your SoC) to catch out-of-bounds writes at runtime. Code review of custom UART drivers and applications that inherit or mirror the vulnerable pattern is recommended.

Why prioritize this

Despite a CVSS v3.1 base score of 4.2 (Medium), this vulnerability merits attention because: (1) it affects a critical I/O subsystem (UART), (2) it causes memory corruption that can degrade system stability, (3) it requires only adjacent local access (no credentials), and (4) it affects a mature, widely-deployed RTOS (Zephyr) used in industrial, IoT, and automotive embedded systems. However, the narrow scope (PIC32CM-JH only, non-default config, single-byte buffer edge case) and lack of remote exploitability mean it is lower priority than network-facing vulnerabilities or flaws affecting default configurations. Organizations with large Zephyr deployments should patch during routine maintenance windows; others should assess whether they use this specific hardware and configuration combination.

Risk score, explained

The CVSS v3.1 score of 4.2 reflects: Attack Vector Adjacent (A) = local UART access only, Attack Complexity High (H) = specific config and code pattern required, Privileges Required None (N) = no authentication, User Interaction None (N) = automatic upon receipt of crafted serial data, Scope Unchanged (U) = impact confined to the device, Confidentiality None (C:N), Integrity Low (I:L) = single-byte adjacent corruption, Availability Low (A:L) = possible denial of service via memory corruption or crash. The score appropriately downgrades severity because exploitation is not practical across generic Zephyr deployments and impact is limited to localized memory corruption rather than code execution or widespread data loss.

Frequently asked questions