CVE-2026-10667

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.14.0 through 4.4.0

Description Dynamic kernel-object tracking in the kernel/userspace/userspace.c file maintains a doubly-linked list obj list of dynamically allocated kernel objects. A race condition exists on SMP systems because iteration over this list in the k object wordlist foreach() function occurs under lists lock, while the removal and freeing of nodes are handled by different, disjoint spinlocks: objfree lock in k object free() and obj lock in unref check(). This allows one CPU to unlink and free a dyn obj node that another CPU has cached as its next pointer, leading to a use-after-free scenario where the iterator dereferences freed kernel memory. These operations are accessible to unprivileged user-mode threads via system calls, including k object alloc, k object alloc size, and k object release. This can result in kernel memory corruption, potentially leading to privilege escalation, or a kernel crash causing a denial of service. The issue specifically affects configurations using CONFIG SMP, CONFIG USERSPACE, and CONFIG DYNAMIC OBJECTS.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary mitigation, avoid using configurations that combine CONFIG SMP, CONFIG USERSPACE, and CONFIG DYNAMIC OBJECTS.