The Microchip SERCOM‑G1 UART driver, used in the PIC32CM‑JH SoC family, has an out‑of‑bounds write in its asynchronous DMA receive path. When uart_rx_enable() is called with a one‑byte receive buffer and CONFIG_UART_MCHP_ASYNC is enabled, the RX‑complete interrupt routine starts a single‑beat DMA transfer while a byte is already pending in the driver’s DATA register. On this SoC the peripheral‑triggered DMA writes the received byte one position past the end of the supplied buffer. The overwritten byte contains UART data supplied by the connected serial peer and sits immediately after the buffer, leading to single‑byte memory corruption adjacent to the RX buffer that can cause a crash or denial of service. Exploitation requires asynchronous UART to be enabled (not default on the in‑tree PIC32CM‑JH boards) and a consumer that explicitly enables a one‑byte receive buffer. The defect shipped in kernel version 4.4.0 and was fixed by reading the first byte with the CPU and avoiding DMA for one‑byte buffers.

The vulnerability affects the Zephyr kernel when it includes the Microchip SERCOM‑G1 UART driver for the PIC32CM‑JH family of SoCs. The defect was present in kernel version 4.4.0 and earlier; any release that has not incorporated the specific commit that disables DMA for one‑byte buffers remains vulnerable.

The CVSS score of 4.2 indicates a medium impact severity. The EPSS score of < 1% indicates a very low exploitation probability, and the issue is not recorded in CISA KEV catalog, suggesting limited public exploitation. The exploit requires that asynchronous UART is configured (CONFIG_UART_MCHP_ASYNC enabled) and that a user explicitly enables a one‑byte receive buffer; these prerequisites are not enabled by default on the in‑tree PIC32CM‑JH boards. While the attack surface is narrow, an adjacent attacker connected to the UART could trigger the overflow and cause a crash if the conditions are met.