# CVE-2026-10677: Zephyr OS kernel heap memory leak in z_vrfy_k_poll

Source: https://junglewise.ai/threats/cve-2026-10677-zephyr-os-kernel-heap-memory-leak-in-z-vrfy-k-poll  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-10677 · Severity: medium · CVSS 6.5 · Published 2026-07-21

Zephyr is an open-source operating system designed for resource-constrained IoT devices. A flaw in how the system handles certain internal requests allows a malicious program to repeatedly claim small amounts of memory without ever releasing them. Over time, this exhausts the device's available memory, causing the entire system to crash or stop responding to legitimate tasks.

Technologies: [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-10677 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10677 being exploited in the wild.

**How severe is CVE-2026-10677?** Medium severity, with a CVSS score of 6.5, published 21 July 2026.

**Which products and versions are affected?** Zephyr Project Zephyr OS v1.12.0 to v4.4.1.

**Is there a fix for CVE-2026-10677?** A patch was published on 2026-07-21: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10677 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-10677?** Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory leak exists in the z_vrfy_k_poll() syscall verifier in kernel/poll.c. The function allocates a kernel-side copy of user-supplied poll events using z_thread_malloc(), but fails to free this memory if validation of an object handle fails. Specifically, the use of the K_OOPS macro inside the validation loop terminates the calling thread immediately without executing cleanup code. Because child threads inherit the parent's resource_pool, an attacker can spawn multiple threads to repeatedly trigger this leak, eventually exhausting the kernel heap. This prevents subsequent kernel allocations for queues, messages, or other system calls, leading to a permanent denial of service until reboot. The issue is fixed in version 4.5.0 by ensuring memory is freed before the thread is terminated.

## Affected products

- Zephyr Project Zephyr OS v1.12.0 to v4.4.1

## Timeline

- 2026-07-19: other: Embargo date
- 2026-07-21: disclosed: Advisory published by Zephyr Project
- 2026-07-21: patched: Fix merged into main branch

## References

- [https://github.com/zephyrproject-rtos/zephyr](https://github.com/zephyrproject-rtos/zephyr)
- [https://github.com/zephyrproject-rtos/zephyr/commit/8dc7a37bc75402a0a3329397887f32f5fb4da3ad](https://github.com/zephyrproject-rtos/zephyr/commit/8dc7a37bc75402a0a3329397887f32f5fb4da3ad)
- [https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r3cc-8wcr-xfj9](https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r3cc-8wcr-xfj9)

## Related threats

- [Zephyr MCTP over USB use-after-free in packet buffer handling](https://junglewise.ai/threats/cve-2026-85032-the-mctp-over-usb-device-class-in-subsys-pmci-mctp-mctp-usb-c)
- [Zephyr arm64 MMU TLB invalidation memory isolation bypass](https://junglewise.ai/threats/cve-2026-79979-the-arm64-mmu-backend-invalidates-a-single-virtual-address-from)
- [Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsing](https://junglewise.ai/threats/cve-2026-76787-the-updatehub-firmware-over-the-air-client-parses-the-coap-probe)
- [CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsing](https://junglewise.ai/threats/cve-2026-75084-the-cc1200-sub-ghz-ieee-802-15-4-driver-takes-the-phy-packet)
- [Zephyr Bluetooth Link Layer memory leak in connection update](https://junglewise.ai/threats/cve-2026-19739-the-bluetooth-link-layer-control-procedure-code-in-subsys)