The ADC API in Zephyr requires drivers to reject sampling sequences if the destination buffer is too small. However, the NXP MCUX LPADC driver did not enforce this, allowing unbounded writes beyond the buffer. Specifically, mcux_lpadc_start_read() did not check buffer size before assigning the buffer pointer, and subsequent sampling writes could overflow the buffer. On systems with CONFIG_USERSPACE enabled, unprivileged user-mode threads can exploit this by requesting excessive samples, causing kernel memory corruption. The vulnerability allows attacker-controlled writes into kernel memory, enabling privilege escalation or denial-of-service. The fix introduces adc_sequence_validate_buffer() to verify buffer size before sampling begins, returning an error if insufficient.

This vulnerability enables an unprivileged user-mode thread with access to the LPADC device to cause kernel memory corruption by overflowing the ADC sampling buffer. This can lead to privilege escalation or denial-of-service conditions due to attacker-controlled writes beyond the buffer boundary into kernel memory or other partitions. Systems without CONFIG_USERSPACE are only affected by robustness issues on the caller side. The CVSS 3.1 score is 7.8 (high), reflecting local attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available that adds buffer size validation in the NXP MCUX LPADC driver before sampling starts. The new helper function adc_sequence_validate_buffer() checks that the buffer is large enough and returns an error if not. Users should upgrade to Zephyr version 4.4.2 or later where this fix is included. Until patched, restrict access to the LPADC device for unprivileged user-mode threads to prevent exploitation.