CVE-2026-12235

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description The Linkable Loadable Extensions (llext) subsystem improperly handles PLT/RELA relocation entries when linking relocatable ELF extensions on Xtensa. In the llext link plt() function, the system calculates the patch address using rela.r offset without validating if the offset is within the target section's bounds. Because rela.r offset is read directly from the ELF's RELA table, a crafted entry can trigger an out-of-bounds write in supervisor context during link time via the llext load() function. This can lead to supervisor-context memory corruption, resulting in loss of integrity and availability, or a sandbox-boundary escape for user-mode extensions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.