CVE-2026-10682
Awaiting Analysis Awaiting Analysis - Queue

Integer Underflow in Zephyr RTOS Logging Subsystem

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Zephyr Project

Description
The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative value for src_id (e.g. -1) trivially satisfied this check and was forwarded into z_impl_log_filter_set, where it propagated to filter_set() and ultimately to get_dynamic_filter(), which uses source_id as an unsigned index into the linker-section array &TYPE_SECTION_START(log_dynamic)[source_id].filters. After implicit conversion through uint32_t, an int16_t -1 becomes 0xFFFFFFFF, indexing log_dynamic far out of bounds and causing the kernel to perform an OOB read and an OOB read-modify-write (LOG_FILTER_SLOT_GET/SET) against memory adjacent to the log_dynamic section. The written value is a constrained 3-bit log level slot within the targeted 32-bit word, but the target address is attacker-chosen (a small negative offset from log_dynamic) and the write occurs in supervisor mode following a syscall from an unprivileged user thread, providing a kernel memory-corruption / privilege-escalation primitive. The defect is reachable on any build with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y. Present from Zephyr v3.3.0 through v4.4.1. The fix replaces the signed bound check with an unsigned comparison: (uint32_t)src_id < log_src_cnt_get(domain_id), which correctly rejects negative inputs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-10682
EUVD
EUVD-2026-49398

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zephyr_project zephyr From 3.3.0 (inc) to 4.4.1 (inc)
zephyrproject zephyr From 3.3.0 (inc) to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a kernel memory-corruption vulnerability in the Zephyr RTOS logging subsystem. A negative value for the src_id parameter bypasses a signed comparison check in the userspace verifier. This negative value is converted to a large unsigned integer, causing an out-of-bounds read and write when used as an index into the log_dynamic array. This leads to kernel memory corruption and allows privilege escalation from an unprivileged user thread.

Detection Guidance

This vulnerability is specific to Zephyr RTOS builds with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y. Detection requires checking the kernel configuration and examining the logging subsystem implementation. No direct network detection commands are applicable. Review the Zephyr source code for the affected function z_vrfy_log_filter_set() and verify if the fix from commit 56a1511 is applied.

Impact Analysis

An attacker with access to a vulnerable system could exploit this flaw to corrupt kernel memory, potentially leading to privilege escalation, denial of service, or unauthorized access. The impact depends on the system's configuration and the attacker's capabilities.

Compliance Impact

This vulnerability allows an unprivileged user to corrupt kernel memory via an out-of-bounds write, which could lead to privilege escalation. Such kernel-level exploits may compromise system integrity, potentially violating confidentiality and integrity requirements in standards like GDPR (data protection) and HIPAA (health data security).

Mitigation Strategies

Apply the official patch from commit 56a1511 or upgrade to a Zephyr version beyond v4.4.1. If patching is not immediately possible, disable CONFIG_USERSPACE and CONFIG_LOG_RUNTIME_FILTERING in the kernel configuration to prevent exploitation. Monitor Zephyr project advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart