CVE-2026-19676

Name of the Vulnerable Software and Affected Versions Zephyr OS (affected versions not specified)

Description An issue exists in the user-mode verifier for the peci transfer() system call, specifically within the z vrfy peci transfer() function in drivers/peci/peci handlers.c. The verifier only validates the outer structure of the caller-supplied peci msg using k usermode from copy(), leaving the buf pointers and len values within the tx buffer and rx buffer members of the embedded peci buf structure fully controlled by the user. These unchecked values are then passed to drivers such as peci npcx transfer(), peci it8xxx2 transfer(), peci xec read(), and peci xec write(), which dereference the pointers in supervisor mode.

A user-mode thread with access to the PECI device object can manipulate rx buffer.buf to point to kernel data structures, allowing the driver to write hardware-supplied bytes into kernel memory, or manipulate tx buffer.buf to point to kernel memory and leak its contents onto the PECI/eSPI out-of-band bus. This can lead to a full user-mode-to-kernel escape, enabling arbitrary kernel write (resulting in code execution at supervisor privilege), arbitrary kernel read, or a supervisor-mode fault if an unmapped address is used.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.