Executive brief
Zephyr's Linkable Loadable Extensions (llext) subsystem, used to dynamically load code modules on embedded systems, contains a flaw in how it processes relocation entries when linking ELF extensions. An attacker can craft a malicious ELF file that causes an out-of-bounds memory write in supervisor context, potentially corrupting system memory and escaping security sandboxes before the extension even executes.
Technical details
The vulnerability is an out-of-bounds write in the llext_link_plt() function (subsys/llext/llext_link.c) when processing PLT/RELA relocation entries for Xtensa relocatable ELF objects. The root cause is missing bounds validation on the rela.r_offset field read directly from the ELF RELA table; the code computes a patch address without checking whether r_offset exceeds the target section size. An attacker can supply a crafted ELF extension with an oversized r_offset value, causing the write to land outside the extension's text buffer. The attack occurs during llext_load() in supervisor context before any extension code executes, affecting systems that load untrusted extensions on Xtensa platforms with writable storage. The fix adds a bounds check rejecting RELA entries where r_offset >= tgt->sh_size, mirroring validation already present in the shared/dynamic code path.
Affected products
- Zephyr Zephyr RTOS <unknown
Timeline
- 2026-08-12: disclosed