Out-of-Bounds Write Vulnerability in Microchip UART Driver

CVE-2026-10644

What is CVE-2026-10644?

The Microchip SERCOM-G1 UART driver has a vulnerability caused by an out-of-bounds write in its asynchronous receive path. When utilizing the uart_rx_enable() function with a one-byte receive buffer and enabling CONFIG_UART_MCHP_ASYNC, the RX-complete ISR may trigger a DMA transfer while a byte is still awaiting processing. This results in a write operation that exceeds the allocated buffer size, potentially leading to memory corruption. The overflowed memory could be manipulated by adjacent attackers, resulting in loss of data integrity, crashes, or denial of service. Users are advised to ensure proper configurations are in place and apply the fix included in the latest versions of the driver.

References