CVE-2026-10669

Name of the Vulnerable Software and Affected Versions Zephyr OS versions 3.7.0 through 4.4.0

Description On Xtensa SoCs configured with CONFIG XTENSA MPU and CONFIG USERSPACE, the arch buffer validate() function in arch/xtensa/core/mpu.c incorrectly permits access to memory when a buffer's rounded extent wraps the 32-bit address space. This occurs because the function defaults its return value to 0 (permitted) and only sets a denial result within a loop that may execute zero iterations if an overflow occurs during the ROUND UP process. Consequently, syscall-layer pre-checks fail to catch this specific wrap, and the string path via arch user string nlen lacks guards entirely.

An unprivileged user-mode thread can provide crafted addr and size parameters to syscalls utilizing k usermode from copy(), k usermode to copy(), or k usermode string copy(). This allows the kernel to read from or write to restricted kernel or other-partition memory, leading to information disclosure, memory corruption, privilege escalation, and denial of service.

Recommendations Update Zephyr OS to a version later than 4.4.0. As a temporary mitigation, restrict the use of syscalls that rely on k usermode from copy(), k usermode to copy(), or k usermode string copy() for untrusted user-mode inputs.