Zephyr RTOS Microchip SERCOM-G1 UART Out-of-bounds Write Vulnerability Analysis (CVE-2026-10644)

Vulnerability Overview Vulnerability Name: Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer Vulnerability Description: A out-of-bounds write vulnerability exists in the Microchip SERCOM-G1 UART driver ( ) when using the PIC32CM-JH SoC family. The vulnerability occurs when is called, is enabled, the receive buffer contains only one byte, and a received byte is pending in the SERCOM DATA register. The CVE ID for this vulnerability is CVE-2026-10644. Affected Versions Affected Components: Affected Versions: v4.4.0 (PIC32CM-JH / SERCOM-G1 UART with CONFIG_UART_MCHP_ASYNC) Remediation Fix Status: Fixed (merged silently), merged into the branch but not yet released. The expected fix version is 4.5.0. Fix Code: The fix code has been merged into the branch, with commit . The fix code has also been merged into the branch, with commit . Evidence Analysis/agent_v172512bc0070/commit.diff5: The maintainer pointed out that a buffer overflow issue exists when the buffer size is 1 byte. drivers/serial/uart_mchp_sercom_g1.c:967-1004: Post-processing: read the first byte; if , DMA is bypassed; otherwise, DMA reloads . drivers/serial/uart_mchp_sercom_g1.c:2129-2137: Pre-DMA load: ; ISR calls at line 975, initiating full-length DMA while is pending. drivers/dma/dma_mchp_dmac_g1.c:160-164,388-391,412-436: PERIPHERAL_TO_MEMORY burst trigger increments DSTADDR. With BTCNT=0, no further DMA occurs, indicating an SoC DMA startup sequence. git log --onelines: Shows that in v4.4.0 contains pre- ISR logic -> vulnerable code. subsys/shell/backends/shell_uart.c/drivers/serial/uart_mchp_sercom_g1.c/subsys/modem/subsys/mchp/mchp_uart.c: Asynchronous consumers in the tree use multi-byte buffers; the case was not triggered. Patch More Information For any questions or comments, please submit via the following links: - Open an issue in Zephyr - Send an email via Zephyr Vulnerability Reporting Embargo Date: 2026-06-20

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr RTOS Microchip SERCOM-G1 UART Out-of-bounds Write Vulnerability Analysis (CVE-2026-10644)

More from this source