CVE-2026-19736

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The NXP MCUX TRNG entropy driver in drivers/entropy/entropy mcux trng.c contains a flaw where it passes the caller's byte count directly to the vendor SDK routine TRNG GetRandomData(). On i.MX RT5xx and RT6xx parts using the TRNG SW HEALTH TESTS variant, the SDK copies data in 32-bit words and rounds entropy draws up to multiples of 128 bytes. If a request length is not a multiple of four, a dataSize underflow occurs, causing the SDK to write up to 127 bytes beyond the allocated buffer.

This issue can be triggered via the entropy get entropy() syscall. When CONFIG USERSPACE is enabled, an unprivileged user-mode thread can specify a destination address and a length (e.g., 1 byte) to cause the kernel to overwrite adjacent kernel state in SRAM, as these Cortex-M33 targets lack a Memory Management Unit (MMU). The defect also affects kernel-mode callers requesting non-word-multiple lengths, including getentropy(), sys rand8 get(), and sys rand16 get().

Impact includes deterministic memory corruption of up to 127 bytes following the supplied buffer, which may lead to system crashes, unpredictable state corruption, or privilege escalation by overwriting kernel bookkeeping such as object permission bitmaps. Affected devices include MIMXRT595S, MIMXRT555S, MIMXRT533S, MIMXRT685S, and MIMXRT633S.

Recommendations Update the NXP MCUX TRNG entropy driver to a version that routes unaligned prefixes and sub-word tails through a local bounce word, ensuring only word-multiple sizes are passed to the SDK. Restrict access to the entropy device for unprivileged user-mode threads to minimize the risk of kernel memory corruption.