CVE-2026-90833

Name of the Vulnerable Software and Affected Versions Zephyr OS (affected versions not specified)

Description The simulated EEPROM driver contains an integer overflow in the eeprom range is valid() function within drivers/eeprom/eeprom simulator.c. The validation check (offset + len) <= config->size uses a signed off t for offset and an unsigned size t for len. This causes the addition to be evaluated using unsigned arithmetic, allowing a negative offset combined with a large len to wrap around and pass the range check. Consequently, eeprom sim read() and eeprom sim write() can perform memcpy() operations on memory located before the mock eeprom array via pointer arithmetic.

Since eeprom read() and eeprom write() are system call entry points that do not validate the offset argument, an unprivileged thread in a build with CONFIG USERSPACE=y and a CONFIG EEPROM SIMULATOR instance can trigger this behavior. This allows an attacker to perform out-of-bounds reads of kernel .bss memory or out-of-bounds writes to kernel memory preceding the mock eeprom array, potentially leading to kernel state corruption and a user-mode sandbox escape.

Recommendations Update the simulated EEPROM driver to a version that rejects negative offsets and performs bound checks without overflow. As a temporary mitigation, disable the CONFIG EEPROM SIMULATOR device instance or restrict access to the eeprom read() and eeprom write() system calls for unprivileged threads.