PT-2026-62124 · Zephyr · Zephyr

CVE-2026-10677

·

Published

2026-07-21

·

Updated

2026-07-21

CVSS v3.1

6.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Zephyr versions 1.12.0 through 4.4.1
Description The z vrfy k poll() syscall verifier in kernel/poll.c allocates a kernel-side copy of the user-supplied k poll event[] using z thread malloc(). When validating object handles, the use of K OOPS(K SYSCALL OBJ(...)) inside the loop kills the calling thread without freeing the events copy buffer. An attacker can exploit this by passing num events greater than or equal to 1 with a forged object handle to leak memory. By spawning multiple threads that inherit the parent's resource pool, the shared kernel heap can be exhausted, leading to a system-level denial of service where legitimate kernel allocations, such as k queue nodes and k msgq buffers, fail.
Recommendations Update Zephyr to a version later than 4.4.1.

Exploit

Fix

Memory Leak

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-10677
GHSA-R3CC-8WCR-XFJ9

Affected Products

Zephyr