CVE-2026-10682

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.3.0 through 4.4.1

Description The userspace verifier z vrfy log filter set() for the log filter set syscall in subsys/logging/log mgmt.c uses a signed comparison for the src id parameter. A negative value provided to src id can bypass the boundary check and be passed to z impl log filter set, filter set(), and get dynamic filter(). Because get dynamic filter() uses source id as an unsigned index, a negative int16 t value is converted to a large uint32 t value, leading to an Out-of-Bounds (OOB) read and an OOB read-modify-write against memory adjacent to the log dynamic section. This allows an unprivileged user thread to perform a write in supervisor mode at an attacker-chosen address, creating a kernel memory-corruption and privilege-escalation primitive. This issue affects builds with CONFIG USERSPACE=y and CONFIG LOG RUNTIME FILTERING=y.

Recommendations Update Zephyr to a version later than 4.4.1. As a temporary mitigation, disable CONFIG USERSPACE or CONFIG LOG RUNTIME FILTERING in the build configuration.