PT-2026-62124 · Zephyr · Zephyr
CVE-2026-10677
·
Published
2026-07-21
·
Updated
2026-07-21
CVSS v3.1
6.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Zephyr versions 1.12.0 through 4.4.1
Description
The
z vrfy k poll() syscall verifier in kernel/poll.c allocates a kernel-side copy of the user-supplied k poll event[] using z thread malloc(). When validating object handles, the use of K OOPS(K SYSCALL OBJ(...)) inside the loop kills the calling thread without freeing the events copy buffer. An attacker can exploit this by passing num events greater than or equal to 1 with a forged object handle to leak memory. By spawning multiple threads that inherit the parent's resource pool, the shared kernel heap can be exhausted, leading to a system-level denial of service where legitimate kernel allocations, such as k queue nodes and k msgq buffers, fail.Recommendations
Update Zephyr to a version later than 4.4.1.
Exploit
Fix
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zephyr