CVE-2026-63935
Received Received - Intake

Division by Zero in NXP SAR ADC Linux Kernel Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in write_raw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero or a negative value to the sampling_frequency sysfs attribute triggers a division by zero in the kernel. Also prevent unsigned integer underflow when the computed cycle count is smaller than NXP_SAR_ADC_CONV_TIME, which would wrap the u32 inpsamp to a huge value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63935
EUVD
EUVD-2026-45708

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux kernel *
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a division by zero can occur in the NXP SAR ADC driver. It happens when a user writes a zero or negative value to the sampling_frequency sysfs attribute, causing the kernel to attempt dividing by zero during raw data processing.

Detection Guidance

This vulnerability can be detected by checking for attempts to write zero or negative values to the sampling_frequency sysfs attribute in the nxp-sar-adc driver. Monitor kernel logs for division by zero errors or unsigned integer underflow warnings related to the nxp-sar-adc module.

Impact Analysis

This vulnerability could cause a kernel crash or system instability if exploited. It may lead to denial of service by triggering a kernel panic when an attacker or misconfigured application writes invalid values to the sampling frequency attribute.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local denial-of-service issue in the Linux kernel's ADC driver that could crash the system if exploited, but it does not involve data breaches, unauthorized access, or privacy violations that would typically trigger regulatory penalties.

Mitigation Strategies

Apply the Linux kernel patch that adds validation for the sampling_frequency value. Ensure the nxp-sar-adc driver is updated to prevent division by zero and unsigned integer underflow. Restrict access to the sampling_frequency sysfs attribute to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63935. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart