ZephyrProject Zephyr up to 4.4.0 Userspace Dynamic-Objects Subsystem userspace.c thread_idx_alloc race condition

Summaryinfo

A vulnerability, which was classified as very critical, was found in ZephyrProject Zephyr up to 4.4.0. Affected is the function thread_idx_alloc of the file kernel/userspace/userspace.c of the component Userspace Dynamic-Objects Subsystem. Executing a manipulation can lead to race condition. This vulnerability is registered as CVE-2026-10681. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability classified as very critical was found in ZephyrProject Zephyr up to 4.4.0. This vulnerability affects the function thread_idx_alloc of the file kernel/userspace/userspace.c of the component Userspace Dynamic-Objects Subsystem. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index from the global _thread_idx_map[] bitmap without holding lists_lock. On SMP systems, two user-mode threads invoking the k_object_alloc(K_OBJ_THREAD) syscall concurrently can both observe the same low free bit, perform the same non-atomic RMW to clear it, and return the identical tidx. The two newly created K_OBJ_THREAD objects are then assigned the same thread_id, so the two user threads alias a single bit position in every kernel object's perms[] bitfield: any subsequent grant of access on a kernel object to one thread is implicitly a grant to the other, defeating userspace ACL isolation. A secondary lost-update window between the unlocked &=~BIT() in alloc and the locked |= BIT() in thread_idx_free() can also leak entries from the thread-index pool. The defect is reachable from any user-mode thread via the unrestricted __syscall k_object_alloc and is gated on CONFIG_USERSPACE, CONFIG_DYNAMIC_OBJECTS, and CONFIG_SMP. The flaw was introduced when the per-thread permission index was added in 2018 and is present in every release up to and including v4.4.0. Fixed by holding lists_lock across the bitmap RMW and the permissions clear (and inlining the obj_list traversal that previously took the lock itself).

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-10681 since 06/02/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/25/2026).

Upgrading to version 4.5.0 eliminates this vulnerability. Applying the patch 862ea2fbbeb2ccdf8ff994b03e2e3b4405f2c37d is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-49045). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ZephyrProject

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion