Executive brief
Zephyr RTOS is a real-time operating system used in embedded systems and IoT devices. A race condition in the socket message-sending and message-receiving system calls allows an unprivileged local attacker to corrupt kernel memory and gain elevated privileges or crash the system. The vulnerability exists when userspace code is enabled and exploitable without special privileges.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in the z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() verifiers in subsys/net/lib/sockets/sockets.c. The kernel copies the user-supplied net_msghdr struct once, but then re-reads mutable fields (particularly msg_iovlen) from the original user-space memory for both buffer sizing and loop bounds. A second thread in the same memory domain can modify msg_iovlen between these reads, causing the iovec population loop to write attacker-controlled values past the allocated shadow buffer on the kernel heap. This is reachable from unprivileged user threads whenever CONFIG_USERSPACE is enabled. Successful exploitation corrupts kernel-managed heap memory across privilege boundaries, enabling local privilege escalation or kernel denial of service. The fix copies the msghdr once and derives all sizing, bounds, and gates from the snapshot, copying each iovec atomically.
Affected products
- Zephyr Project Zephyr RTOS Versions with CONFIG_USERSPACE enabled prior to commit 2e0f9cf
Timeline
- 2026-08-12: disclosed
- 2026-06-12: patched: Fix committed to main branch