The zephyrproject's Linkable Loadable Extensions subsystem incorrectly processes PLT/RELA relocation entries when linking a partially‑linked ELF extension for Xtensa. The calculation of the patch address uses an r_offset value from the ELF’s RELA table without validating that it lies within the bounds of the target section. A malformed entry with an offset beyond the target section results in a supervisor‑level out‑of‑bounds write located at whatever address the offset points to, and the written value is the resolved symbol address. This flaw is a classic out‑of‑bounds write (CWE‑787) that corrupts supervisor‑context memory and can potentially allow a sandbox‑bound user‑mode extension to escape its privilege boundary.

The only explicit vendor/product listed is the Zephyr real‑time operating system. No specific version information is given in the advisory, so any build that includes the ll_ext subsystem on Xtensa processors and accepts loadable extensions of untrusted origin may be affected. The vulnerability is triggered only when an application loads an attacker‑influenced ELF extension on Xtensa platforms that provide writable storage for extensions.

The calibrated CVSS score of 6.3 indicates a moderate severity, and the EPSS score is not available, which does not allow an exact probability assessment. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread exploitation. Exploitation requires the attacker to supply a crafted ELF extension that is loaded by an application, which is a high‑privilege operation that is typically restricted in production systems. Turning the out‑of‑range write into a reliable code‑execution primitive is described as non‑trivial, so the practical risk is limited to memory corruption and potential sandbox escape rather than immediate arbitrary code execution.