CVE-2026-12364 in Zephyr
Summary
by MITRE • 08/14/2026
The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation z_impl_z_log_msg_static_create() without performing any of the mandatory K_SYSCALL_* checks. Because z_log_msg_static_create() is declared __syscall, under CONFIG_USERSPACE any unprivileged user-mode thread can invoke it directly with fully attacker-controlled arguments.
The kernel-mode handler dereferences each of these untrusted values: frontend_runtime_filtering() reads through the source pointer as a struct log_source_dynamic_data, cbprintf_package_copy() reads desc.package_len bytes from the package pointer, and z_log_msg_finalize() performs a memcpy() of desc.data_len bytes from the data pointer. With no verification, a user thread can supply arbitrary kernel addresses and arbitrary lengths, and the kernel will read from them.
The impact is a kernel-mode denial of service (the kernel faults dereferencing an attacker-chosen pointer) and, where a log backend output is observable to the attacker, disclosure of arbitrary kernel memory copied into the emitted log message — a confidentiality breach across the user/kernel boundary that the userspace sandbox is meant to enforce. The reads do not corrupt kernel memory, so there is no out-of-bounds write primitive.
The fix adds the required validation to the verifier: it bounds desc.package_len against Z_LOG_MSG_MAX_PACKAGE, rejects non-NULL/length mismatches, and applies K_SYSCALL_MEMORY_READ() to package, data, and (when runtime filtering with a frontend is enabled) source, so any out-of-bounds or kernel pointer now raises K_OOPS instead of being honored.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability exists within the zephyr operating system's logging subsystem where the user-space system-call verifier function z_vrfy_z_log_msg_static_create() fails to perform essential validation checks before forwarding parameters to the kernel-mode implementation. This flaw represents a classic case of inadequate input sanitization in a privileged execution context, allowing unprivileged user-mode threads to directly invoke the _syscall decorated z_log_msg_static_create() function under CONFIG_USERSPACE configurations. The verifier's design constitutes a pure pass-through mechanism that bypasses all mandatory K_SYSCALL* checks, creating an exploitable pathway for kernel memory access violations.
The technical exploitation occurs through three distinct kernel-mode dereference operations that process the unvalidated user-supplied arguments. The frontend_runtime_filtering() function attempts to interpret the source pointer as a struct log_source_dynamic_data structure, while cbprintf_package_copy() reads desc.package_len bytes from the package pointer without bounds checking. Additionally, z_log_msg_finalize() executes a memcpy() operation of desc.data_len bytes from the data pointer, all without any validation of memory access permissions or address ranges. This combination of operations creates a scenario where attackers can supply arbitrary kernel addresses and length parameters, effectively bypassing the userspace sandbox protections that are fundamental to system security.
The operational impact spans both confidentiality and availability domains, creating multiple attack vectors for malicious actors. The primary vulnerability manifests as a kernel-mode denial of service condition where the kernel faults when attempting to dereference attacker-controlled pointers, leading to system crashes or hangs. More critically, when log backend outputs are accessible to attackers, this vulnerability enables arbitrary kernel memory disclosure through log message generation, representing a significant confidentiality breach across the user/kernel boundary. The vulnerability specifically maps to CWE-125: Out-of-Bounds Read within the Common Weakness Enumeration framework, and aligns with ATT&CK technique T1059.003: Command and Scripting Interpreter for privilege escalation through kernel memory access.
The mitigation strategy implemented in the fix addresses each validation gap within the system-call verifier by establishing proper bounds checking mechanisms. The solution introduces validation of desc.package_len against Z_LOG_MSG_MAX_PACKAGE to prevent excessive memory reads, implements rejection of non-NULL pointer/length mismatches to maintain data integrity, and applies K_SYSCALL_MEMORY_READ() checks to the package, data, and source parameters when runtime filtering is enabled. These changes ensure that any out-of-bounds memory access attempts or kernel address dereferences now trigger K_OOPS exceptions rather than being silently honored, effectively restoring proper sandbox boundaries and preventing both the denial of service and memory disclosure conditions that the original vulnerability enabled. The fix represents a comprehensive approach to system call validation that aligns with secure coding practices and maintains the integrity of the kernel-userspace boundary enforcement mechanisms.