CVE-2026-19669

The user-mode syscall verifiers z vrfy fuel gauge get props() and z vrfy fuel gauge set props() in drivers/fuel gauge/fuel gauge syscall handlers.c declared two variable-length arrays, union fuel gauge prop val k vals[len] and fuel gauge prop t k props[len], sized directly by the caller-supplied len argument. len is an unvalidated size t taken straight from the syscall ABI, and the VLAs were allocated before any check at all — including before the K SYSCALL DRIVER FUEL GAUGE() object-permission check. The subsequent k usermode from copy() calls validated only that the user source buffer was readable; the kernel destination was never bounds-checked, since it was sized by the same attacker-chosen len.

Any thread running in user mode with CONFIG USERSPACE enabled can invoke fuel gauge get props() or fuel gauge set props() with a large len. This first displaces the supervisor stack pointer by an arbitrary attacker-chosen amount — Zephyr does not build with stack-clash probing, so the displacement itself does not fault, and the nested calls made by the verifier then write frames below the privileged stack. If the caller has been granted access to a fuel-gauge device object, the memcpy inside k usermode from copy() additionally writes len * sizeof(union fuel gauge prop val) bytes of fully attacker-controlled data starting well below the stack base. CONFIG PRIVILEGED STACK SIZE defaults to 1024 bytes, so a len of roughly 170 already exhausts it.

The result is an out-of-bounds write in supervisor mode with attacker-controlled length and, on the permitted path, attacker-controlled content — a break out of the user-mode sandbox into kernel memory, leading to kernel code execution or a system crash. A stack guard region does not contain it, because the copy begins below the guard and walks upward, corrupting unprotected memory before the guard is reached. The fix removes the kernel-side copies entirely and validates the caller's arrays in place with K SYSCALL MEMORY ARRAY READ() / K SYSCALL MEMORY ARRAY WRITE(), which also handle the len * size multiplication overflow; this is safe because neither fuel gauge prop t nor union fuel gauge prop val contains embedded pointers.