CVE-2026-19736: bounds in zephyrproject zephyr

The vulnerability arises because the entropy driver passes the caller's requested byte count directly to the vendor SDK's TRNG_GetRandomData() function, which on affected i.MX RT5xx and RT6xx parts compiles a variant that copies entropy in 32-bit words rounded up to multiples of 128 bytes. If the requested length is not a multiple of four, the SDK's guard check underflows and causes it to write beyond the caller's buffer by up to 127 bytes. This overflow can occur in both user and kernel mode, with user mode able to specify arbitrary destination and length via a syscall. The overflow can corrupt kernel memory or adjacent user partitions due to the lack of MMU on Cortex-M33. The vulnerability affects devices where the MCUX SDK enables TRNG_SW_HEALTH_TESTS (MIMXRT595S, MIMXRT555S, MIMXRT533S, MIMXRT685S, MIMXRT633S). The fix involves routing unaligned prefixes and tails through a local bounce buffer and only passing word-aligned sizes to the SDK, preventing overflow.

The vulnerability allows memory corruption of up to 127 bytes immediately following the caller's buffer. This can lead to crashes, unpredictable system state corruption, and potential privilege escalation if kernel bookkeeping data structures are overwritten. The overflow is deterministic in offset but the data written is uncontrolled entropy output. The affected devices share SRAM between user partitions and kernel due to lack of MMU, increasing the risk of cross-partition corruption.

A patch is available that fixes the vulnerability by ensuring only word-aligned sizes are passed to the SDK and handling unaligned data via a local bounce buffer. Users should apply the official fix in Zephyr versions >=4.3.0 and <=4.4.2. Since this is a kernel-level vulnerability affecting specific hardware, upgrading to the fixed Zephyr release is the recommended mitigation.