Buffer Overflow Risk in NXP MCUX LPADC Driver for Zephyr

CVE-2026-18413

What is CVE-2026-18413?

The NXP MCUX LPADC driver for the Zephyr project contains a buffer overflow vulnerability that arises when the driver fails to validate the size of its input buffers adequately. In scenarios where user-mode threads interact with the ADC driver, improperly sized buffers can lead to data being written beyond the allocated memory boundaries. This occurs during the sampling process, where an internal mechanism allows for data storage in user-supplied buffers. For example, a two-byte buffer configured to handle multiple samples can quickly overflow, potentially leading to kernel memory corruption and unauthorized access to critical areas of memory from user-mode, which can result in privilege escalation or denial of service. A patch has been added to validate the buffer size prior to sampling to address this issue.

References