Executive brief
Zephyr RTOS is an open-source operating system designed for resource-constrained devices. A security flaw in the memory protection logic for Xtensa processors allows a malicious user-mode application to bypass memory access restrictions. This could enable an attacker to read sensitive kernel data, corrupt system memory, or gain elevated privileges, potentially leading to a full system takeover or device failure.
Technical details
A vulnerability exists in the arch_buffer_validate() function within arch/xtensa/core/mpu.c for Xtensa SoCs configured with CONFIG_XTENSA_MPU and CONFIG_USERSPACE. The function incorrectly defaulted its return value to 0 (access permitted) and only performed denial checks within a loop that probes MPU regions. By providing a crafted buffer address and size that causes a 32-bit integer overflow during the ROUND_UP calculation, an attacker can cause the validation loop to execute zero times, resulting in a successful validation of unauthorized memory. This bypasses syscall-layer memory checks and allows unprivileged user-mode threads to perform arbitrary reads or writes to kernel or other-partition memory. The issue is fixed by defaulting to a denial state, adding explicit overflow checks, and only returning success after the entire range is validated.
Affected products
- Zephyr Project Zephyr RTOS v3.7.0 to v4.4.0
Timeline
- 2024-03-19: other: Vulnerability introduced in version 3.7.0
- 2026-07-14: advisory: GHSA-4r4p-gh69-v6w4 published
- 2026-07-14: disclosed: CVE-2026-10669 published
- 2026-07-14: patched: Fix merged into main and stable branches