CVE-2026-19736: NXP MCUX TRNG Buffer Overflow Vulnerability

CVE-2026-19736 Overview

CVE-2026-19736 is an out-of-bounds write vulnerability [CWE-787] in the Zephyr RTOS NXP MCUX True Random Number Generator (TRNG) entropy driver located at drivers/entropy/entropy_mcux_trng.c. The driver forwards caller-supplied byte counts directly to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT5xx and RT6xx parts, the SDK writes entropy in 32-bit word units and only checks dataSize == 0, causing a non-word-multiple length to underflow and overwrite memory beyond the caller's buffer. A 1-byte request results in 128 bytes written.

Critical Impact
An unprivileged user-mode thread with access to the entropy device can trigger up to 127 bytes of kernel memory corruption on affected Cortex-M33 targets, enabling potential privilege escalation.

Affected Products

Zephyr RTOS builds using drivers/entropy/entropy_mcux_trng.c on NXP i.MX RT5xx/RT6xx
NXP MIMXRT595S, MIMXRT555S, and MIMXRT533S SoCs
NXP MIMXRT685S and MIMXRT633S SoCs

Discovery Timeline

2026-10-11 - CVE-2026-19736 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-19736

Vulnerability Analysis

The defect resides in the glue code between the Zephyr entropy driver and the NXP MCUX SDK. When TRNG_SW_HEALTH_TESTS is enabled, the SDK's TRNG_GetRandomData() operates on 32-bit words and rounds internal entropy extraction up to multiples of 128 bytes. The SDK's termination check tests dataSize == 0 after decrementing by four, so any length not divisible by four causes an integer underflow. The copy loop then continues writing until the next word boundary and beyond, up to the next 128-byte alignment.

The entropy_get_entropy() function is exposed as a Zephyr syscall. Its verifier in drivers/entropy/entropy_handlers.c validates only the requested length through K_SYSCALL_MEMORY_WRITE(). The verifier confirms the thread owns the requested region but cannot anticipate that the driver will write more bytes than requested.

The same path is reachable from kernel mode through getentropy(), and in builds where sys_csrand_get() or sys_rand_get() resolve to the hardware generator, through sys_rand8_get() and sys_rand16_get().

Root Cause

The Zephyr driver passes the caller's byte count directly to a vendor SDK function that only accepts word-multiple sizes. The SDK's internal guard uses equality rather than a signed or less-than comparison, allowing dataSize to underflow past zero on non-aligned requests.

Attack Vector

An unprivileged user-mode thread that has been granted access to the entropy device issues an entropy_get_entropy() syscall with a destination buffer it owns and a length such as 1. The syscall verifier approves the one-byte write. The driver then invokes the SDK, which writes up to 128 bytes starting at that address. On affected Cortex-M33 targets, there is no MMU, so user partitions and kernel data share one SRAM region. The overflow can land in adjacent kernel bookkeeping, including object permission bitmaps.

#define DT_DRV_COMPAT nxp_kinetis_trng

#include <errno.h>
+#include <string.h>

 #include <zephyr/device.h>
 #include <zephyr/drivers/entropy.h>
 #include <zephyr/random/random.h>
 #include <zephyr/pm/device.h>
 #include <zephyr/init.h>
+#include <zephyr/sys/util.h>

 #include "fsl_trng.h"

Source: Zephyr Commit 2c132efaf03a5d45aeaf7b0531c1107db7a36a3d. The patch routes any unaligned prefix and sub-word tail through a local bounce word, so the SDK only receives word-multiple sizes.

Detection Methods for CVE-2026-19736

Indicators of Compromise

Unexplained kernel panics, hard faults, or memory management faults on NXP i.MX RT5xx/RT6xx targets following entropy requests
Corruption of kernel object permission bitmaps or stack canaries adjacent to entropy destination buffers
Application code paths invoking entropy_get_entropy(), getentropy(), sys_rand8_get(), or sys_rand16_get() with lengths that are not multiples of four

Detection Strategies

Audit firmware builds for CONFIG_ENTROPY_MCUX_TRNG=y combined with the affected SoC targets and CONFIG_USERSPACE=y
Perform static analysis on application code to locate entropy API calls with sub-word or non-aligned length arguments
Build with hardware watchpoints or MPU-based guard regions placed immediately after entropy destination buffers to trap overflow writes during QA

Monitoring Recommendations

Capture crash telemetry and fault registers from fielded devices, correlating fault addresses with entropy call sites
Review Zephyr system call tracing logs for anomalous entropy_get_entropy invocations from unprivileged threads
Track upstream Zephyr security advisories at GHSA-3f6q-3949-rqph for additional guidance

How to Mitigate CVE-2026-19736

Immediate Actions Required

Apply the upstream Zephyr fix in commit 2c132efaf03a5d45aeaf7b0531c1107db7a36a3d to all firmware images targeting affected NXP SoCs
Audit application and library code for entropy requests with non-word-multiple lengths and align them to four-byte boundaries as an interim step
Restrict k_object grants for the entropy device so only trusted threads can invoke the syscall under CONFIG_USERSPACE

Patch Information

The fix is published in the Zephyr Project repository at commit 2c132efaf03a5d45aeaf7b0531c1107db7a36a3d. It introduces a local bounce word that absorbs any unaligned prefix and sub-word tail, ensuring the SDK's TRNG_GetRandomData() only receives word-multiple sizes. Full advisory details are available in GHSA-3f6q-3949-rqph.

Workarounds

Wrap entropy API calls in application code so all requests are rounded up to multiples of four bytes, then truncate the returned data to the desired length
Disable CONFIG_USERSPACE on affected devices where user-mode isolation is not required, closing the syscall-driven attack surface
Switch to an alternate entropy source such as a software CSPRNG seeded at boot where product requirements allow

bash

# Verify patched Zephyr source is in use
cd zephyr
git log --oneline drivers/entropy/entropy_mcux_trng.c | grep 2c132efa

# Confirm build configuration for affected targets
west build -b mimxrt685_evk -- -DCONFIG_ENTROPY_MCUX_TRNG=y