CVE-2026-18414: Zephyr ADI MAX32 ADC Privilege Escalation

CVE-2026-18414 Overview

CVE-2026-18414 is an out-of-bounds write vulnerability [CWE-787] in the Zephyr RTOS Analog-to-Digital Converter (ADC) driver for Analog Devices MAX32 devices. The start_read() function in drivers/adc/adc_max32.c compares the caller-supplied buffer_size (a byte count) against a sample count, ignoring sizeof(uint16_t). This accepts buffers that are half the required size and causes the driver to write two bytes per sample past the buffer boundary. On builds with CONFIG_USERSPACE enabled, an unprivileged user-mode thread holding access to a MAX32 ADC device object can trigger the driver to corrupt kernel memory.

Critical Impact
An unprivileged user-mode thread can trigger kernel-memory corruption of attacker-controlled length at an attacker-controlled offset, enabling privilege escalation and denial of service.

Affected Products

Zephyr RTOS ADI MAX32 ADC driver (drivers/adc/adc_max32.c)
Zephyr builds with CONFIG_USERSPACE enabled and access to a MAX32 ADC device object
Related ADC drivers using the shared validation helper (e.g., drivers/adc/adc_mcux_lpadc.c)

Discovery Timeline

2026-09-28 - CVE-2026-18414 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-18414

Vulnerability Analysis

The ADC API contract in include/zephyr/drivers/adc.h requires each driver to reject sampling sequences whose destination buffer is too small. The MAX32 driver violated that contract. start_read() performed the size check by comparing buffer_size in bytes against (1 + extra_samplings) * channels, a sample count. The comparison omitted the sizeof(uint16_t) multiplier that reflects the two-byte width of each ADC sample.

After passing this check, Wrap_MXC_ADC_GetData() writes two bytes per sample through data->buffer and advances the pointer by one uint16_t. Writes occur in adc_max32_start_channel() for synchronous reads and adc_max32_isr() for asynchronous reads. A two-channel sequence supplied with a two-byte buffer passes validation, and the second sample is written past the buffer end.

Root Cause

The defect is a unit mismatch in bounds validation. The check treated a byte count as a sample count, permitting buffers half the required size. Because the overrun scales with extra_samplings and the sample pointer is never rewound during a sequence, the write can extend up to channels * 65536 bytes past the buffer end.

Attack Vector

With CONFIG_USERSPACE, adc_read() and adc_read_async() are system calls. The handler in drivers/adc/adc_handlers.c verifies only that [buffer, buffer + buffer_size) is writable by the calling thread and leaves size arithmetic to the driver. A user-mode thread granted access to a MAX32 ADC device controls channels, buffer, buffer_size, and options->extra_samplings. The resulting stores execute in kernel mode where the MPU does not restrict the thread's memory domain, so writes walk linearly into adjacent partitions, kernel data, or thread stacks.

// Fix: shared helper adc_sequence_validate_buffer() in drivers/adc/adc_common.c
int adc_sequence_validate_buffer(const struct adc_sequence *sequence,
				 uint8_t active_channels, size_t data_size)
{
	size_t needed = (size_t)active_channels * data_size;

	if (sequence->options) {
		needed *= (1 + sequence->options->extra_samplings);
	}

	if (sequence->buffer_size < needed) {
		return -ENOMEM;
	}

	return 0;
}
// Source: [Zephyr commit 9338c518](https://github.com/zephyrproject-rtos/zephyr/commit/9338c518bf2b6a396f166d4dbe9985ce7e44379c)

Detection Methods for CVE-2026-18414

Indicators of Compromise

Unexpected kernel panics, memory faults, or thread stack corruption on Zephyr targets using the MAX32 ADC driver.
ADC sampling operations initiated by user-mode threads with buffer_size values inconsistent with channels * sizeof(uint16_t) * (1 + extra_samplings).
Anomalous writes into kernel data regions or adjacent memory partitions following adc_read() or adc_read_async() system calls.

Detection Strategies

Audit Zephyr firmware images and build configurations for CONFIG_USERSPACE=y together with the MAX32 ADC driver enabled.
Perform static analysis on ADC driver call sites to identify buffer sizes that do not account for sizeof(uint16_t).
Add runtime assertions or fuzzing harnesses that exercise adc_read() with malformed buffer_size and extra_samplings combinations.

Monitoring Recommendations

Enable Zephyr fault handlers and MPU exception logging to capture out-of-bounds write attempts during ADC operations.
Track firmware crash telemetry from fielded devices for signatures consistent with kernel memory corruption after ADC use.
Verify that deployed builds include the fixed adc_common.c helper by checking commit hashes 3bda971a and 9338c518.

How to Mitigate CVE-2026-18414

Immediate Actions Required

Apply the upstream Zephyr patches that route MAX32 ADC buffer validation through adc_sequence_validate_buffer().
Revoke user-mode thread access to MAX32 ADC device objects until the fix is deployed on affected devices.
Rebuild and reflash firmware images that ship with CONFIG_USERSPACE=y and the vulnerable driver.

Patch Information

The fix is available in Zephyr via two commits. The common validation helper commit 9338c518 introduces adc_sequence_validate_buffer() in drivers/adc/adc_common.c, which computes active_channels * sizeof(uint16_t) * (1 + extra_samplings) and returns -ENOMEM before sampling starts. The driver update commit 3bda971a replaces the incorrect check in start_read() with a call to the new helper. See GHSA-ghm4-78mm-8v2c for the full advisory.

Workarounds

Disable CONFIG_USERSPACE on affected builds if user-mode isolation is not required, reducing the issue to a caller-side robustness defect.
Restrict MAX32 ADC device object permissions so only trusted kernel-mode code invokes adc_read() and adc_read_async().
Validate buffer_size in application code before calling ADC APIs, ensuring it satisfies channels * sizeof(uint16_t) * (1 + extra_samplings).

bash

# Verify patched Zephyr tree contains the fix commits
cd zephyr
git log --oneline | grep -E "3bda971a|9338c518"
grep -n "adc_sequence_validate_buffer" drivers/adc/adc_common.c drivers/adc/adc_max32.c