ZephyrProject Zephyr up to 1.12.0/4.4.1 Syscall Verifier kernel/poll.c z_vrfy_k_poll k_poll_event allocation of resources

Summaryinfo

A vulnerability was found in ZephyrProject Zephyr up to 1.12.0/4.4.1. It has been rated as problematic. The affected element is the function z_vrfy_k_poll of the file kernel/poll.c of the component Syscall Verifier. The manipulation of the argument k_poll_event leads to allocation of resources. This vulnerability is documented as CVE-2026-10677. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in ZephyrProject Zephyr up to 1.12.0/4.4.1 and classified as problematic. This issue affects the function z_vrfy_k_poll of the file kernel/poll.c of the component Syscall Verifier. The manipulation of the argument k_poll_event with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy. A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service. The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-10677 since 06/02/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 4.5.0 eliminates this vulnerability. Applying the patch 8dc7a37bc75402a0a3329397887f32f5fb4da3ad is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Project Management Software

Vendor

• ZephyrProject

Name

• Zephyr

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12.0
• 4.4.0
• 4.4.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion