Zephyr Project up to 4.4.1 Linkable Loadable Extensions llext_link.c llext_link_plt r_offset out-of-bounds write

Summaryinfo

A vulnerability has been found in Zephyr Project Zephyr up to 4.4.1 and classified as problematic. The impacted element is the function llext_link_plt of the file subsys/llext/llext_link.c of the component Linkable Loadable Extensions. Performing a manipulation of the argument r_offset results in out-of-bounds write. This vulnerability was named CVE-2026-12235. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability was found in Zephyr Project Zephyr up to 4.4.1. It has been classified as problematic. This affects the function llext_link_plt of the file subsys/llext/llext_link.c of the component Linkable Loadable Extensions. The manipulation of the argument r_offset with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on integrity, and availability. The summary by CVE is:

The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and then performed the relocation write there without validating rela.r_offset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llext_file_offset(). rela.r_offset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via r_offset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs. The path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial. The fix adds a bound check rejecting any RELA entry whose r_offset >= tgt->sh_size, mirroring the existing validation in the shared branch.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-12235 since 06/15/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.4.2 eliminates this vulnerability. Applying the patch 106540afbd22087ad40b90f53fb22657754a719e is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-57070). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• Zephyr Project

Name

• Zephyr

Version

• 4.4.0
• 4.4.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion