Zephyr Project up to 4.4.x Fuel Gauge Syscall fuel_gauge_syscall_handlers.c len out-of-bounds write

Summaryinfo

A vulnerability described as very critical has been identified in Zephyr Project Zephyr up to 4.4.x. Affected by this issue is the function z_vrfy_fuel_gauge_get_props/z_vrfy_fuel_gauge_set_props of the file drivers/fuel_gauge/fuel_gauge_syscall_handlers.c of the component Fuel Gauge Syscall Handler. The manipulation of the argument len results in out-of-bounds write. This vulnerability is identified as CVE-2026-19669. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as very critical has been found in Zephyr Project Zephyr up to 4.4.x. Affected is the function z_vrfy_fuel_gauge_get_props/z_vrfy_fuel_gauge_set_props of the file drivers/fuel_gauge/fuel_gauge_syscall_handlers.c of the component Fuel Gauge Syscall Handler. The manipulation of the argument len with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-length arrays, union fuel_gauge_prop_val k_vals[len] and fuel_gauge_prop_t k_props[len], sized directly by the caller-supplied len argument. len is an unvalidated size_t taken straight from the syscall ABI, and the VLAs were allocated before any check at all — including before the K_SYSCALL_DRIVER_FUEL_GAUGE() object-permission check. The subsequent k_usermode_from_copy() calls validated only that the user source buffer was readable; the kernel destination was never bounds-checked, since it was sized by the same attacker-chosen len. Any thread running in user mode with CONFIG_USERSPACE enabled can invoke fuel_gauge_get_props() or fuel_gauge_set_props() with a large len. This first displaces the supervisor stack pointer by an arbitrary attacker-chosen amount — Zephyr does not build with stack-clash probing, so the displacement itself does not fault, and the nested calls made by the verifier then write frames below the privileged stack. If the caller has been granted access to a fuel-gauge device object, the memcpy inside k_usermode_from_copy() additionally writes len * sizeof(union fuel_gauge_prop_val) bytes of fully attacker-controlled data starting well below the stack base. CONFIG_PRIVILEGED_STACK_SIZE defaults to 1024 bytes, so a len of roughly 170 already exhausts it. The result is an out-of-bounds write in supervisor mode with attacker-controlled length and, on the permitted path, attacker-controlled content — a break out of the user-mode sandbox into kernel memory, leading to kernel code execution or a system crash. A stack guard region does not contain it, because the copy begins below the guard and walks upward, corrupting unprotected memory before the guard is reached. The fix removes the kernel-side copies entirely and validates the caller's arrays in place with K_SYSCALL_MEMORY_ARRAY_READ() / K_SYSCALL_MEMORY_ARRAY_WRITE(), which also handle the len * size multiplication overflow; this is safe because neither fuel_gauge_prop_t nor union fuel_gauge_prop_val contains embedded pointers.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-19669 since 08/12/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/11/2026).

Upgrading to version 4.5.0 eliminates this vulnerability. Applying the patch 0d65ce46dda0626164503c50f37e6e1f59d310a9 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Project Management Software

Vendor

• Zephyr Project

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion