CVE-2026-12235

Awaiting Analysis Awaiting Analysis - Queue

llext Out-of-Bounds Write in Zephyr RTOS

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: Zephyr Project

Description

The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and then performed the relocation write there without validating rela.r_offset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llext_file_offset(). rela.r_offset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via r_offset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs. The path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial. The fix adds a bound check rejecting any RELA entry whose r_offset >= tgt->sh_size, mirroring the existing validation in the shared branch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-12235

EUVD

EUVD-2026-57070

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	From 3.7.0 (inc) to 4.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linkable Loadable Extensions (llext) subsystem of Zephyr RTOS. It involves improper handling of relocation entries in ELF files, specifically when linking relocatable objects for Xtensa architecture. The system computes write targets for relocation without validating if the offset falls within the target section's bounds, leading to out-of-bounds writes in kernel memory during extension loading.

Detection Guidance

Detecting this vulnerability requires checking Zephyr RTOS versions and LLEXT configuration. Use 'zephyr_version' or check 'CONFIG_LLEXT' in kernel config. Inspect loaded extensions for malformed ELF files with 'readelf -r <extension.elf>' to check RELA entries for invalid r_offset values.

Impact Analysis

This vulnerability can lead to kernel memory corruption, hard faults, loader-state corruption, or potential control-flow hijacking. It allows an attacker to influence memory writes in supervisor context before any extension code runs, potentially escaping sandbox boundaries if untrusted extensions are loaded.

Compliance Impact

This vulnerability primarily impacts system integrity and availability through kernel memory corruption, which could lead to unauthorized code execution or denial of service. For compliance standards like GDPR or HIPAA, which require robust security measures to protect data integrity and availability, this vulnerability could undermine compliance by enabling unauthorized access or disruption of systems handling sensitive data.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.4.2 or later. Disable CONFIG_LLEXT if untrusted extensions are not required. Avoid loading untrusted ELF extensions until patched. Monitor kernel logs for loader errors indicating failed relocations.

Hi! I’m here to help you understand CVE-2026-12235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70