CVE-2026-63935: Linux Kernel NXP SAR ADC DoS Vulnerability

CVE-2026-63935 Overview

CVE-2026-63935 is a Linux kernel vulnerability in the NXP Successive Approximation Register Analog-to-Digital Converter (SAR ADC) Industrial I/O (IIO) driver. The driver's write_raw handler fails to validate the sampling frequency value written through the sampling_frequency sysfs attribute. A user writing zero or a negative value triggers a division by zero in kernel context. A related unsigned integer underflow occurs when the computed cycle count is smaller than NXP_SAR_ADC_CONV_TIME, wrapping the u32 inpsamp variable to a large value. Both flaws affect kernel stability and reliability on affected NXP hardware platforms.

Critical Impact
A local user with write access to the IIO sysfs interface can trigger a kernel division by zero or an unsigned integer underflow, leading to denial of service or unpredictable ADC configuration.

Affected Products

Linux kernel builds including the nxp-sar-adc IIO ADC driver
Systems using NXP SoCs that rely on the SAR ADC driver for sampling
Distributions shipping the affected driver prior to the referenced stable kernel commits

Discovery Timeline

2026-07-19 - CVE-2026-63935 published to the National Vulnerability Database (NVD)
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63935

Vulnerability Analysis

The defect lives in the write_raw callback of the nxp-sar-adc IIO driver. When a userspace process writes to the sampling_frequency sysfs attribute, the driver uses the supplied value as a divisor to compute ADC timing parameters. The driver does not check the value before performing the division. A write of 0 or a negative integer causes a kernel-mode division by zero exception. The second defect involves an unsigned integer underflow. When the computed cycle count is smaller than NXP_SAR_ADC_CONV_TIME, the subtraction wraps the u32 inpsamp variable to a very large value. This corrupts subsequent ADC timing configuration.

Root Cause

The root cause is missing input validation on user-supplied values before arithmetic use. The write_raw path accepts the sampling frequency without range or sign checks, and the subsequent cycle-count computation does not guard against underflow of the unsigned result [CWE-369, CWE-191].

Attack Vector

Exploitation requires local access with permission to write to the affected IIO sysfs attribute, typically /sys/bus/iio/devices/iio:deviceN/sampling_frequency. An attacker with such access writes 0 or a negative integer to trigger the divide-by-zero. Writing a small positive value that produces a cycle count below NXP_SAR_ADC_CONV_TIME triggers the underflow path. The vulnerability is not remotely exploitable and does not permit code execution.

No public proof-of-concept exploit code is available for CVE-2026-63935. The fix, published in the kernel stable tree commit a9aba21a and commit cb6ea15e, adds validation of the sampling frequency prior to its use as a divisor and prevents the inpsamp underflow.

Detection Methods for CVE-2026-63935

Indicators of Compromise

Kernel oops or panic messages referencing divide error inside the nxp-sar-adc module in dmesg or /var/log/kern.log
Repeated userspace writes of 0, negative values, or very small integers to sampling_frequency under /sys/bus/iio/devices/
Abnormal ADC timing behavior or driver reinitialization events on affected NXP platforms

Detection Strategies

Monitor kernel logs for divide-by-zero traces originating in iio/adc/nxp-sar-adc.c or the write_raw call path
Audit processes writing to IIO sysfs attributes using Linux audit rules on /sys/bus/iio/devices/*/sampling_frequency
Track unexpected kernel crashes on systems using NXP SoCs with the SAR ADC driver loaded

Monitoring Recommendations

Enable auditd watches on IIO sysfs paths to capture the writing process, user, and value
Ship kernel ring buffer output to a central log platform and alert on divide_error or Oops events tied to IIO modules
Track uptime and unplanned reboots on embedded devices running the affected driver

How to Mitigate CVE-2026-63935

Immediate Actions Required

Apply the stable kernel updates that include commits a9aba21a and cb6ea15e to patched branches
Restrict write permissions on /sys/bus/iio/devices/*/sampling_frequency to trusted users and services only
Inventory NXP-based systems that load the nxp-sar-adc driver and prioritize them for patching

Patch Information

The upstream fix adds a validation check on the sampling frequency before using it as a divisor and prevents the u32 inpsamp underflow when the cycle count would fall below NXP_SAR_ADC_CONV_TIME. Refer to the kernel commit a9aba21a and kernel commit cb6ea15e for the exact code changes and to identify which stable branches include the fix.

Workarounds

Tighten filesystem permissions on the affected sysfs attributes so only privileged processes can write sampling frequency values
Unload or blacklist the nxp-sar-adc module on systems that do not require ADC functionality
Wrap userspace ADC configuration in a validated helper that rejects zero, negative, or out-of-range sampling frequency inputs before writing to sysfs

bash

# Restrict write access to the affected IIO sysfs attribute
chmod 600 /sys/bus/iio/devices/iio:device0/sampling_frequency

# Audit writes to IIO sampling frequency attributes
auditctl -w /sys/bus/iio/devices/ -p w -k iio_sar_adc_write