Executive brief
A vulnerability in the Linux kernel's Greybus driver for BeaglePlay hardware could allow a buffer overflow during firmware updates. This occurs when the system receives more data than it can store while communicating with the device's bootloader. An exploit could lead to system instability or a crash, potentially impacting the reliability of devices using this specific hardware interface.
Technical details
A buffer overflow exists in the cc1352_bootloader_rx() function within drivers/greybus/gb-beagleplay.c. The function appends incoming serdev data chunks into a fixed-size rx_buffer using memcpy() without verifying if the remaining space is sufficient. Because the helper can retain leftover bytes between callbacks and process multiple packets simultaneously, the 'count' parameter can exceed the available buffer capacity. An attacker with the ability to send malformed or oversized serial data to the bootloader interface could trigger a heap-based overflow. The fix introduces a check to ensure the incoming chunk fits in the remaining buffer space, dropping the data if it would cause an overflow.
Affected products
- Linux Linux Kernel Fixed in 0339a746ff7cd3f9d10f565e89c99dc93191e58d, 1214bf28965ceaf584fb20d357731264dd2e10e1, 663c2728a6d0f781044431111b53a27f71027e48, fb91d4e49fcbea0b5091394ac5b8f7d4124265c3
Timeline
- 2026-04-02: disclosed: Initial patch submission
- 2026-05-07: patched: Patch committed to stable tree
- 2026-06-09: advisory: NVD publication date