CVE-2026-19669: Zephyr fuel gauge syscall stack buffer overflow

CVE-2026-19669 · Severity: high · CVSS 7.8 · Published 2026-10-11

Zephyr's fuel gauge driver contains a privilege escalation flaw in syscall handlers that validate user-supplied requests. An attacker in user mode can provide an arbitrarily large array size to trigger allocation of oversized buffers on the privileged kernel stack, leading to out-of-bounds writes with attacker-controlled data. This breaks the sandbox isolation between user and kernel mode, allowing arbitrary code execution with kernel privileges.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-19669 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19669 being exploited in the wild.
How severe is CVE-2026-19669?
High severity, with a CVSS score of 7.8, published 11 October 2026.
Which products and versions are affected?
Zephyr RTOS affected versions not specified in advisory.
Is there a fix for CVE-2026-19669?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19669 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-19669?
Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() syscall verifiers in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c allocate variable-length arrays (VLAs) sized directly by an unvalidated caller-supplied len parameter, bypassing bounds checks and permission validation. The subsequent k_usermode_from_copy() call memcpy's attacker-controlled data without validating the destination bounds. Any thread with CONFIG_USERSPACE enabled can trigger a stack buffer overflow on the privileged stack; threads with fuel-gauge device permissions can additionally write fully attacker-controlled content.

Affected products

  • Zephyr Zephyr RTOS affected versions not specified in advisory

Timeline

  • 2026-10-11: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.