Executive brief
Zephyr is an open-source operating system designed for resource-constrained IoT devices. A flaw in how the system handles certain internal requests allows a malicious program to repeatedly claim small amounts of memory without ever releasing them. Over time, this exhausts the device's available memory, causing the entire system to crash or stop responding to legitimate tasks.
Technical details
A memory leak exists in the z_vrfy_k_poll() syscall verifier in kernel/poll.c. The function allocates a kernel-side copy of user-supplied poll events using z_thread_malloc(), but fails to free this memory if validation of an object handle fails. Specifically, the use of the K_OOPS macro inside the validation loop terminates the calling thread immediately without executing cleanup code. Because child threads inherit the parent's resource_pool, an attacker can spawn multiple threads to repeatedly trigger this leak, eventually exhausting the kernel heap. This prevents subsequent kernel allocations for queues, messages, or other system calls, leading to a permanent denial of service until reboot. The issue is fixed in version 4.5.0 by ensuring memory is freed before the thread is terminated.
Affected products
- Zephyr Project Zephyr OS v1.12.0 to v4.4.1
Timeline
- 2026-07-19: other: Embargo date
- 2026-07-21: disclosed: Advisory published by Zephyr Project
- 2026-07-21: patched: Fix merged into main branch