CVE-2026-63935: iio: adc: nxp-sar-adc: fix division by zero in write_raw
Published Jul 19, 2026
·
Updated
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: nxp-sar-adc: fix division by zero in writeraw
Add a validation check for the sampling frequency value before using it
as a divisor. A user writing zero or a negative value to the
samplingfrequency sysfs attribute triggers a division by zero in the
kernel.
Also prevent unsigned integer underflow when the computed cycle count is
smaller than NXPSARADCCONVTIME, which would wrap the u32 inpsamp to
a huge value.
SecAlerts Pty Ltd. 132 Wickham Terrace Fortitude Valley, QLD 4006, Australia info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
What access does an attacker need to trigger the issue?
An attacker needs local access with permission to write to the ADC device's sampling_frequency sysfs attribute. Writing zero or a negative sampling-frequency value can trigger a kernel division by zero.
2
What is the likely impact of exploitation?
The issue can cause a kernel failure or denial of service. The affected calculation can also underflow when the computed cycle count is below NXP_SAR_ADC_CONV_TIME, producing an unexpectedly large unsigned value.
3
How can I determine whether a system is exposed?
Check whether the system uses the NXP SAR ADC driver and exposes its sampling_frequency sysfs attribute to a local user. Exposure requires that a user able to write that attribute can supply zero or negative values.
4
What should be done if patching cannot be applied immediately?
Restrict write access to the affected sampling_frequency sysfs attribute so untrusted local users cannot set it. Avoid setting the sampling frequency to zero, negative values, or values that produce a computed cycle count below NXP_SAR_ADC_CONV_TIME.