CVE-2026-10667

{
  "id": "CVE-2026-10667",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-12T17:16:24.670",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated kernel objects. Iteration over this list in k_object_wordlist_foreach() was performed under lists_lock using the SAFE iterator (which caches the next node), but list removal and freeing of nodes was performed under different, disjoint spinlocks: objfree_lock in k_object_free() and obj_lock in unref_check(). On an SMP system, while one CPU iterated obj_list under lists_lock, another CPU could unlink and k_free() the dyn_obj node that the iterator had cached as its next pointer, causing the iterator to dereference freed kernel memory (use-after-free / dangling list traversal). All of the racing operations are reachable from unprivileged user-mode threads via system calls: k_object_alloc/k_object_alloc_size and k_object_release drive removals through unref_check() (under obj_lock), while k_thread_abort and thread creation drive the iteration through k_thread_perms_all_clear()/k_thread_perms_inherit() (under lists_lock). A deprivileged user thread on a CONFIG_SMP + CONFIG_USERSPACE build can therefore corrupt the kernel's object-tracking structures across the userspace security boundary, yielding kernel memory corruption (potential privilege escalation) or a kernel crash (denial of service). The fix removes objfree_lock and serializes every obj_list modification under lists_lock, including holding it across find+remove in k_object_free() and around unref_check() in k_thread_perms_clear(). Affects CONFIG_SMP+CONFIG_USERSPACE+CONFIG_DYNAMIC_OBJECTS configurations; the defect dates to the 2019 spinlockification (commit 8a3d57b6cc6, first released in v1.14.0) and shipped through v4.4.0."
    },
    {
      "lang": "es",
      "value": "El seguimiento dinámico de objetos del kernel de Zephyr (kernel/userspace/userspace.c, anteriormente kernel/userspace.c) mantiene una lista doblemente enlazada (obj_list) de objetos del kernel asignados dinámicamente. La iteración sobre esta lista en k_object_wordlist_foreach() se realizaba bajo lists_lock usando el iterador SAFE (que almacena en caché el siguiente nodo), pero la eliminación de la lista y la liberación de nodos se realizaban bajo diferentes spinlocks disjuntos: objfree_lock en k_object_free() y obj_lock en unref_check(). En un sistema SMP, mientras una CPU iteraba obj_list bajo lists_lock, otra CPU podía desenlazar y k_free() el nodo dyn_obj que el iterador había almacenado en caché como su puntero siguiente, haciendo que el iterador desreferenciara memoria del kernel liberada (uso después de liberación / recorrido de lista colgante). Todas las operaciones de carrera son accesibles desde hilos de modo de usuario sin privilegios a través de llamadas al sistema: k_object_alloc/k_object_alloc_size y k_object_release impulsan las eliminaciones a través de unref_check() (bajo obj_lock), mientras que k_thread_abort y la creación de hilos impulsan la iteración a través de k_thread_perms_all_clear()/k_thread_perms_inherit() (bajo lists_lock). Un hilo de usuario desprivilegiado en una compilación CONFIG_SMP + CONFIG_USERSPACE puede, por lo tanto, corromper las estructuras de seguimiento de objetos del kernel a través del límite de seguridad del espacio de usuario, lo que resulta en corrupción de memoria del kernel (potencial escalada de privilegios) o un fallo del kernel (denegación de servicio). La solución elimina objfree_lock y serializa cada modificación de obj_list bajo lists_lock, incluyendo mantenerlo durante la búsqueda+eliminación en k_object_free() y alrededor de unref_check() en k_thread_perms_clear(). Afecta a las configuraciones CONFIG_SMP+CONFIG_USERSPACE+CONFIG_DYNAMIC_OBJECTS; el defecto data de la ’spinlockificación’ de 2019 (commit 8a3d57b6cc6, lanzado por primera vez en v1.14.0) y se distribuyó hasta v4.4.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "kernel/userspace/userspace.c"
          ],
          "versions": [
            {
              "version": "1.14.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T15:49:41.562734Z",
          "id": "CVE-2026-10667",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.14.0",
              "versionEndIncluding": "4.4.1",
              "matchCriteriaId": "1DE6EBF0-408C-45ED-9CC9-79EF99E3DFDD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/fdc42fa256b8c2a7b27790f032d5385f8058c4a9",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9x5j-h3rh-x579",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9x5j-h3rh-x579",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}