CVE-2026-10677 in Zephyr
Summary
by MITRE • 07/22/2026
The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy.
A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service.
The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability described represents a critical resource management flaw in the Zephyr real-time operating system's kernel subsystem, specifically within the CONFIG_USERSPACE syscall verifier implementation. This issue manifests in the z_vrfy_k_poll() function located in kernel/poll.c, which serves as a crucial interface for user-mode applications to interact with kernel polling mechanisms. The flaw stems from improper memory cleanup during error handling scenarios, creating a systematic pathway for resource exhaustion attacks that can ultimately lead to complete system denial of service.
The technical root cause lies in the validation process of k_poll_event[] structures where the function allocates kernel-side copies using z_thread_malloc() and subsequently validates each event's object handle. The original implementation employed K_OOPS(K_SYSCALL_OBJ(...)) inline within a processing loop, which executes an immediate thread termination without proper memory deallocation. This design flaw creates a memory leak condition where the events_copy buffer remains allocated in kernel memory even when validation fails, allowing attackers to repeatedly exploit this path to consume available kernel heap resources.
The operational impact of this vulnerability extends beyond simple resource leakage to encompass complete system compromise through denial of service attacks. Attackers can leverage this weakness by spawning sacrificial user threads that deliberately trigger the flawed validation path with forged object handles and excessive event counts. Due to Zephyr's thread inheritance model where newly spawned threads inherit their parent's resource_pool, attackers can systematically exhaust shared kernel heap allocations through repeated exploitation attempts. This inheritance mechanism creates a cascading effect where each successful attack consumes more memory from the shared pool, eventually depleting resources needed for legitimate system operations.
The vulnerability affects Zephyr versions spanning from v1.12.0 through v4.4.1, representing a substantial time window of releases that would have been exposed to this persistent flaw. This broad impact scope indicates the severity and longevity of the issue within the operating system's design, as the k_poll syscall was first introduced to user mode in v1.12.0 and remained vulnerable through the latest supported versions. The attack vector specifically targets the kernel heap management subsystem, creating a scenario where legitimate kernel allocations for essential components like k_queue alloc nodes, k_msgq buffers, and future k_poll calls begin failing once the shared resource pool is exhausted.
The fix implemented addresses this vulnerability by replacing the immediate inline K_OOPS calls with conditional error handling that includes explicit memory cleanup before thread termination. This approach employs a goto oops_free mechanism that ensures proper buffer deallocation regardless of validation failure conditions, thereby preventing the memory leak that enabled the denial of service attack. The solution aligns with established security practices for resource management and follows the principle of least privilege by ensuring that error conditions do not leave system resources in inconsistent states.
This vulnerability pattern corresponds to CWE-401: Improper Release of Memory Before Removing Last Reference, which specifically addresses memory leaks occurring during error handling scenarios. From an ATT&CK framework perspective, this represents a privilege escalation and denial of service technique where an attacker leverages insufficient input validation to consume system resources, ultimately leading to system instability. The vulnerability demonstrates how seemingly minor implementation details in kernel subsystems can create significant security risks, particularly when dealing with shared resource pools and improper error handling patterns that leave system resources in inconsistent states.
The fix mechanism directly addresses the fundamental issue by implementing proper error recovery procedures that maintain system integrity even during failure conditions. This approach prevents attackers from exploiting the memory leak to exhaust kernel resources, thereby preserving system stability and preventing the cascading failures that would occur when legitimate kernel allocations begin failing due to resource exhaustion. The solution demonstrates a robust approach to memory management in kernel contexts where error handling must preserve system state while maintaining security boundaries between user and kernel modes.