CVE-2026-10644

Name of the Vulnerable Software and Affected Versions Microchip SERCOM-G1 UART driver version 4.4.0

Description An out-of-bounds write exists in the asynchronous (DMA) receive path of the Microchip SERCOM-G1 UART driver (drivers/serial/uart mchp sercom g1.c) used by the PIC32CM-JH SoC family. The issue occurs when the uart rx enable() function is called with a one-byte receive buffer while CONFIG UART MCHP ASYNC is enabled. In this scenario, the RX-complete ISR initiates a single-beat DMA transfer while a byte is already pending in the SERCOM DATA register, causing the peripheral-triggered DMA start sequencing to write one byte past the end of the provided buffer. This results in single-byte memory corruption adjacent to the RX buffer, which may lead to a system crash or denial of service. The value of the overflowed byte is controlled by the connected serial peer.

Recommendations Update the Microchip SERCOM-G1 UART driver to a version where the uart rx enable() function is modified to read the first byte with the CPU and skip DMA for one-byte buffers, or size the DMA for the remaining bytes in larger buffers.