# CVE-2026-17053: Zephyr SMBus syscall privilege escalation in callback removal

Source: https://junglewise.ai/threats/cve-2026-17053-the-smbus-driver-api-exposed-smbus-smbalert-remove-cb-and-smbus  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-17053 · Severity: medium · CVSS 4.4 · Published 2026-10-01

Zephyr's real-time operating system exposed SMBus (System Management Bus) callback removal functions as unprivileged system calls without proper memory access validation. An unprivileged user-mode thread can invoke these calls with arbitrary pointers to disable alert handling for critical hardware events, potentially silencing hardware malfunction notifications across the system.

Technologies: [Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-zephyr-os). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-17053 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17053 being exploited in the wild.

**How severe is CVE-2026-17053?** Medium severity, with a CVSS score of 4.4, published 1 October 2026.

**Which products and versions are affected?** Zephyr OS versions prior to the fix for CVE-2026-17053 with CONFIG_USERSPACE=y, CONFIG_SMBUS=y, and SMBus driver with SMBALERT or Host Notify support enabled.

**Is there a fix for CVE-2026-17053?** Yes: fixed in Addressed by removing both syscall entry points and demoting the functions to static inline kernel-only calls. Until then: Disable CONFIG_USERSPACE or CONFIG_SMBUS if not required; do not grant unprivileged threads access to SMBus device objects unless callback removal by user-mode code is explicitly required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17053 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-17053?** Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Addressed by removing both syscall entry points and demoting the functions to static inline kernel-only calls

Disable CONFIG_USERSPACE or CONFIG_SMBUS if not required; do not grant unprivileged threads access to SMBus device objects unless callback removal by user-mode code is explicitly required.

## Technical details

The SMBus driver exposes smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls with incomplete verifiers: they validate only the device object but forward an unchecked callback pointer into kernel-mode code. An unprivileged thread with SMBus device access can unregister supervisor-mode callbacks by supplying arbitrary addresses, or on CONFIG_ASSERT=y builds, trigger kernel-mode faults to leak address space layout information via fault/no-fault side channels.

## Affected products

- Zephyr Zephyr OS versions prior to the fix for CVE-2026-17053 with CONFIG_USERSPACE=y, CONFIG_SMBUS=y, and SMBus driver with SMBALERT or Host Notify support enabled

## Timeline

- 2026-10-01: disclosed

## Related threats

- [Zephyr charger driver kernel privilege escalation via user-mode syscall verification](https://junglewise.ai/threats/cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in)
- [Zephyr kernel thread stack memory leak via k_thread_abort](https://junglewise.ai/threats/cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack)
- [Zephyr USB host stack null pointer dereference in device enumeration](https://junglewise.ai/threats/cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a)
- [Zephyr I2S user-mode syscall verifier unvalidated pointer dereference](https://junglewise.ai/threats/cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers)
- [Zephyr AVRCP Target vendor response buffer leak on disconnection](https://junglewise.ai/threats/cve-2026-85033-the-avrcp-target-role-in-subsys-bluetooth-host-classic-avrcp-c)