CVE-2026-63935 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and take steps to mitigate it. This includes applying the patch from the Linux kernel stable repository, validating user input for the sampling_frequency sysfs attribute, and monitoring for unusual activity in the Linux kernel. The vulnerability can be exploited by writing a zero or negative value to the sampling_frequency sysfs attribute, causing a division by zero in the kernel.

Technical summary

The Linux kernel's iio: adc: nxp-sar-adc driver is vulnerable to a division by zero attack. This occurs when a user writes a zero or negative value to the sampling_frequency sysfs attribute, causing a division by zero in the kernel. Additionally, an unsigned integer underflow can occur when the computed cycle count is smaller than NXP_SAR_ADC_CONV_TIME, which would wrap the u32 inpsamp to a huge value. The vulnerability has been resolved by adding a validation check for the sampling frequency value before using it as a divisor.

Defensive priority

High

Recommended defensive actions

• Apply the patch from the Linux kernel stable repository
• Validate user input for the sampling_frequency sysfs attribute
• Monitor for unusual activity in the Linux kernel
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-19T16:17:11.987Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The Linux kernel's iio: adc: nxp-sar-adc driver is vulnerable to a division by zero attack. This occurs when a user writes a zero or negative value to the sampling_frequency sysfs attribute, causing a division by zero in the kernel. Additionally, an unsigned integer underflow can occur when the computed cycle count is smaller than NXP_SAR_ADC_CONV_TIME, which would wrap the u32 inpsamp to a huge value.

Official resources