Executive brief
Zephyr RTOS, a real-time operating system for embedded devices, contains a vulnerability in its logging subsystem. An unprivileged user can trigger a memory corruption error by providing a negative value to a specific system call. This could allow an attacker to crash the system or potentially gain higher-level administrative privileges, compromising the device's security and stability.
Technical details
A vulnerability exists in the Zephyr RTOS userspace verifier 'z_vrfy_log_filter_set()' within 'subsys/logging/log_mgmt.c'. The verifier performs a signed comparison against the 'int16_t src_id' parameter, allowing negative values (e.g., -1) to pass the bounds check. When these values are later treated as unsigned indices into the 'log_dynamic' linker-section array, they result in an out-of-bounds (OOB) read and an OOB read-modify-write operation in supervisor mode. This provides a kernel memory-corruption and privilege-escalation primitive for unprivileged user threads. The issue affects builds with CONFIG_USERSPACE and CONFIG_LOG_RUNTIME_FILTERING enabled and is fixed by implementing an unsigned comparison in the verifier.
Affected products
- Zephyr Project Zephyr RTOS v3.3.0 through v4.4.1
Timeline
- 2026-07-26: other: Embargo date
- 2026-07-27: advisory: GHSA-6vqh-mg7h-58qh published
- 2026-07-27: disclosed: CVE-2026-10682 published