The Microchip SERCOM-G1 UART driver in Zephyr 4.4.0 has an out-of-bounds write vulnerability in its asynchronous DMA receive path for the PIC32CM-JH SoC family. When uart_rx_enable() is called with a one-byte buffer and CONFIG_UART_MCHP_ASYNC is enabled, the RX-complete ISR initiates a DMA transfer that writes one byte beyond the end of the buffer. This overflow byte contains UART RX data from the connected serial peer. Exploitation requires enabling async UART and using a one-byte RX buffer, conditions not enabled by default. The impact is limited to a single-byte memory corruption adjacent to the RX buffer, potentially causing crashes or denial of service. The defect was introduced in version 4.4.0. The fix reads the first byte directly via CPU and disables DMA for one-byte buffers, adjusting DMA size for larger buffers.

The vulnerability causes a single-byte out-of-bounds write adjacent to the RX buffer in the UART driver, which can lead to memory corruption. This may result in application crashes or denial of service. There is no confidentiality or integrity impact reported. Exploitation requires specific UART asynchronous configuration and a one-byte receive buffer, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that reads the first byte with the CPU and disables DMA for one-byte buffers, adjusting DMA size for larger buffers. Until an official patch is available, avoid enabling asynchronous UART with one-byte receive buffers on affected hardware. The vulnerability is not exploitable by default configurations on in-tree PIC32CM-JH boards.