Description
The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy.

A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service.

The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows a user thread to exploit a memory leak in the kernel‑side copy allocation within z_vrfy_k_poll(), causing repeated kernel heap allocations to remain until the resource pool is exhausted. This leakage, triggered when the thread passes a forged object handle, results in the system running out of memory for normal kernel operations, leading to a system‑wide denial of service. The weakness is a classic memory leak (CWE‑401).

Affected Systems

Zephyr Project, all releases from v1.12.0 through v4.4.1 are affected. The issue arises in the CONFIG_USERSPACE subsystem that exposes the k_poll() interface to user mode. No other vendors or products are listed.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackability is inferred to be local: an unprivileged thread must be able to create user processes and invoke k_poll() with a forged handle; thus the threat is limited to devices running a vulnerable Zephyr kernel with user‑mode capabilities. If exploited, the system can suffer a permanent denial of service as legitimate allocations from the kernel heap fail.

Generated by OpenCVE AI on July 30, 2026 at 16:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Zephyr to a version later than v4.4.1 that includes the patch replacing inline K_OOPS with a proper cleanup path.
  • Rebuild the firmware with the applied patch or with the latest stable release from the Zephyr repository to ensure the corrective code is present.
  • If an immediate upgrade is infeasible, reduce or restrict user‑mode thread creation and consider disabling CONFIG_USERSPACE or the k_poll interface to limit the attack surface while monitoring kernel heap usage for abnormal growth.

Generated by OpenCVE AI on July 30, 2026 at 16:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy. A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service. The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.
Title Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool
Weaknesses CWE-401
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-22T19:36:53.593Z

Reserved: 2026-06-02T15:26:07.313Z

Link: CVE-2026-10677

cve-icon Vulnrichment

Updated: 2026-07-22T19:32:17.372Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T16:15:04Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime