CVE-2026-90833: Zephyr RTOS simulated EEPROM driver integer overflow in range validation

CVE-2026-90833 · Severity: high · CVSS 7.8 · Published 2026-11-10

Zephyr RTOS's simulated EEPROM driver contains an integer overflow vulnerability in its range validation logic that allows unprivileged user threads to read and write kernel memory outside the EEPROM bounds. An attacker can exploit this to leak sensitive kernel data or corrupt kernel state to escape the user-mode sandbox. The vulnerability is only exposed when userspace isolation is enabled and a simulated EEPROM device is configured.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-90833 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-90833 being exploited in the wild.
How severe is CVE-2026-90833?
High severity, with a CVSS score of 7.8, published 10 November 2026.
Which products and versions are affected?
Zephyr Project Zephyr RTOS before fix.
Is there a fix for CVE-2026-90833?
Yes: fixed in The advisory does not specify fixed versions; only that the fix rejects negative offsets and performs bounds checking without overflow.. Until then: Disable the simulated EEPROM driver by setting the devicetree status to "disabled" if not required for testing, or do not grant user threads access to the EEPROM device object when CONFIG_USERSPACE is enabled. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90833 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-90833?
Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: The advisory does not specify fixed versions; only that the fix rejects negative offsets and performs bounds checking without overflow.

Disable the simulated EEPROM driver by setting the devicetree status to "disabled" if not required for testing, or do not grant user threads access to the EEPROM device object when CONFIG_USERSPACE is enabled.

Technical details

The vulnerability stems from a signed/unsigned integer overflow in eeprom_range_is_valid() where a negative off_t offset combined with an unsigned size_t length wraps back into the accepted range. Subsequent memcpy() operations via the EEPROM macro perform unvalidated pointer arithmetic on the mock_eeprom array. The eeprom_read() and eeprom_write() syscall entry points do not validate the offset parameter before passing it to the driver, allowing unprivileged threads with device access to supply negative offsets and read/write arbitrary kernel memory adjacent to the EEPROM buffer.

Affected products

  • Zephyr Project Zephyr RTOS before fix

Timeline

  • 2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.