Is CVE-2026-17053 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17053 being exploited in the wild.

How severe is CVE-2026-17053?

Medium severity, with a CVSS score of 4.4, published 1 October 2026.

Which products and versions are affected?

Zephyr OS versions prior to the fix for CVE-2026-17053 with CONFIG_USERSPACE=y, CONFIG_SMBUS=y, and SMBus driver with SMBALERT or Host Notify support enabled.

How is CVE-2026-17053 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-17053?

Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17053: Zephyr SMBus syscall privilege escalation in callback removal

CVE-2026-17053 · Severity: medium · CVSS 4.4 · Published 2026-10-01

Zephyr's real-time operating system exposed SMBus (System Management Bus) callback removal functions as unprivileged system calls without proper memory access validation. An unprivileged user-mode thread can invoke these calls with arbitrary pointers to disable alert handling for critical hardware events, potentially silencing hardware malfunction notifications across the system.

Technologies: Zephyr OS. Vendors: Zephyr.

Quick answers

Is CVE-2026-17053 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17053 being exploited in the wild.
How severe is CVE-2026-17053?: Medium severity, with a CVSS score of 4.4, published 1 October 2026.
Which products and versions are affected?: Zephyr OS versions prior to the fix for CVE-2026-17053 with CONFIG_USERSPACE=y, CONFIG_SMBUS=y, and SMBus driver with SMBALERT or Host Notify support enabled.
Is there a fix for CVE-2026-17053?: Yes: fixed in Addressed by removing both syscall entry points and demoting the functions to static inline kernel-only calls. Until then: Disable CONFIG_USERSPACE or CONFIG_SMBUS if not required; do not grant unprivileged threads access to SMBus device objects unless callback removal by user-mode code is explicitly required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17053 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-17053?: Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Addressed by removing both syscall entry points and demoting the functions to static inline kernel-only calls

Disable CONFIG_USERSPACE or CONFIG_SMBUS if not required; do not grant unprivileged threads access to SMBus device objects unless callback removal by user-mode code is explicitly required.

Technical details

The SMBus driver exposes smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls with incomplete verifiers: they validate only the device object but forward an unchecked callback pointer into kernel-mode code. An unprivileged thread with SMBus device access can unregister supervisor-mode callbacks by supplying arbitrary addresses, or on CONFIG_ASSERT=y builds, trigger kernel-mode faults to leak address space layout information via fault/no-fault side channels.

Affected products

Zephyr Zephyr OS versions prior to the fix for CVE-2026-17053 with CONFIG_USERSPACE=y, CONFIG_SMBUS=y, and SMBus driver with SMBALERT or Host Notify support enabled

Timeline

2026-10-01: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.