CVE-2026-17053

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The SMBus driver API exposes smbus smbalert remove cb() and smbus host notify remove cb() as syscalls. The verifiers for these syscalls only validate the dev argument and fail to perform memory read or write validation on the caller-supplied cb pointer. In builds where CONFIG USERSPACE=y and CONFIG SMBUS=y are enabled, along with specific drivers (such as intel pch smbus.c or smbus stm32.c), an unprivileged user-mode thread with access to the SMBus device object can provide an arbitrary pointer to these syscalls. This allows the thread to unregister SMBALERT or Host Notify callbacks registered by supervisor-mode components, effectively disabling alert handling for the system. Additionally, in builds with CONFIG ASSERT=y, providing a bogus pointer can trigger a kernel-mode fault and a fatal system error, which may be used to disclose mapped addresses.

Recommendations Remove the syscall entry points for smbus smbalert remove cb() and smbus host notify remove cb() and convert them into static inline calls to ensure callback list manipulation is restricted to supervisor-mode code.