CVE-2026-10677

Analyzed Analyzed - Analysis Complete

Memory Leak in Zephyr RTOS Poll Handling

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: Zephyr Project

Description

The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy. A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service. The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-10677

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	From 1.12.0 (inc) to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Zephyr RTOS kernel where a system call verifier improperly handles user-supplied event arrays. It allocates kernel memory for these events but fails to free it when validating object handles, causing memory leaks. Attackers can exploit this by spawning threads to repeatedly trigger the leak until the kernel heap is exhausted, leading to system crashes.

Detection Guidance

This vulnerability affects Zephyr RTOS systems using k_poll with user-supplied handles. Detection requires checking for kernel heap exhaustion symptoms like failed allocations in k_queue, k_msgq, or k_poll calls. Monitor system logs for OOPS messages or thread terminations during k_poll operations.

Impact Analysis

If exploited, this vulnerability can cause a denial of service by exhausting kernel memory. This may crash the system or prevent legitimate kernel operations like message queues or thread scheduling from functioning properly.

Compliance Impact

This vulnerability primarily causes a system-level denial of service by exhausting kernel heap memory, which could lead to service unavailability. It does not directly affect data confidentiality or integrity, so its impact on GDPR or HIPAA compliance is likely minimal unless service disruption violates regulatory requirements for availability.

Mitigation Strategies

Upgrade to Zephyr v4.4.2 or later where the fix is applied. If upgrading is not immediately possible, disable user-mode k_poll usage by removing CONFIG_USERSPACE and CONFIG_K_POLL from your kernel configuration. Monitor system memory usage for heap exhaustion patterns.

Hi! I’m here to help you understand CVE-2026-10677. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70