CVE-2026-10677

{
  "id": "CVE-2026-10677",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:16:59.923",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy.\n\nA user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service.\n\nThe fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1."
    },
    {
      "lang": "es",
      "value": "El verificador de llamadas al sistema CONFIG_USERSPACE z_vrfy_k_poll() en kernel/poll.c asigna una copia del lado del kernel del k_poll_event[] proporcionado por el usuario a través de z_thread_malloc() y luego valida el identificador de objeto de cada evento. Antes de esta corrección, la validación utilizaba K_OOPS(K_SYSCALL_OBJ(...)) en línea dentro del bucle, lo que mata el hilo llamador sin liberar events_copy.\n\nUn hilo de usuario puede pasar num_events >= 1 con un identificador de objeto falsificado para filtrar la asignación; debido a que los hilos de usuario recién creados heredan el resource_pool del padre (kernel/thread.c), un atacante genera hilos de sacrificio para repetir la fuga hasta que el heap compartido del kernel se agote. Una vez agotado, las asignaciones legítimas del kernel de ese pool (nodos de asignación k_queue, búferes k_msgq, futuras llamadas k_poll, etc.) fallan, causando una denegación de servicio a nivel de sistema.\n\nLa corrección reemplaza cada K_OOPS en línea con un goto condicional oops_free para que el búfer sea liberado antes de que el hilo sea terminado. Afecta a las versiones de Zephyr desde v1.12.0 (cuando k_poll se expuso por primera vez al modo de usuario) hasta v4.4.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "kernel/poll.c"
          ],
          "versions": [
            {
              "version": "1.12.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T19:32:15.826317Z",
          "id": "CVE-2026-10677",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.12.0",
              "versionEndIncluding": "4.4.1",
              "matchCriteriaId": "91373C2B-F263-4990-87DF-1602ECDA7FD4"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/8dc7a37bc75402a0a3329397887f32f5fb4da3ad",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r3cc-8wcr-xfj9",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}