Description
The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-written doorbell register, extracted the payload length with IPC_HEADER_GET_LENGTH(), and passed that length straight to sedi_ipc_read_msg() to copy the message into struct ipm_sedi_context.incoming_data_buf, without checking it against the buffer size. The doorbell length field is 10 bits wide (IPC_HEADER_LENGTH_MASK is 0x03FF), so it can encode up to 1023 bytes, while incoming_data_buf is IPC_DATA_LEN_MAX (128) bytes. The bounds check in the underlying HAL sedi_ipc_read_msg() is a DBG_CHECK that compiles away unless CONFIG_DEBUG is set, so no check remained in a production image.

The doorbell register is written by the peer processor on the other side of the IPC link — for the intel_ish_5_* targets, the host CPU's ISH driver, reached through the device's memory-mapped register window. Host-side software with driver-level or raw BAR access can therefore set a length of up to 1023 and cause the interrupt handler to copy far past the destination buffer. The affected path requires an application to have registered an IPM receive callback via ipm_register_callback(), which is the driver's normal mode of use.

The result is an out-of-bounds write of up to 895 bytes into static (.bss) memory, performed in interrupt context. The overflow first clobbers the rest of struct ipm_sedi_context — including the k_sem and k_mutex used by the transmit path, whose wait queues contain self-referential list pointers — and then adjacent static data, giving a kernel data-structure corruption and crash primitive. The overflowing bytes are read from registers following the message window, a portion of which are themselves peer-programmable. The fix rejects any doorbell whose encoded length exceeds IPC_DATA_LEN_MAX, logging it and acknowledging the doorbell so the peer is not left waiting.
Published: 2026-09-21
Score: 6 Medium
EPSS: n/a
KEV: No
Impact: kernel data‑structure corruption
Action: Patch Immediately
AI Analysis

Impact

The driver for Intel SEDI inter‑processor mailboxes (IPM) in Zephyr lacks an upper bound check on the length field obtained from the inbound doorbell. The 10‑bit field can encode up to 1023 bytes, but the destination buffer is only 128 bytes. When the handler copies the payload into this buffer during an interrupt, bytes overflow into static memory, corrupting the semaphore and mutex structures used by the transmit path. The crash occurs in interrupt context and does not depend on race conditions, making it a reliable kernel crash or privilege escalation primitive. This is a classic example of an out‑of‑bounds write (CWE‑787). The vulnerability originates when a peer processor—typically the host CPU running the Intel ISH driver—writes to the IPC doorbell register with a user‑supplied length. If an application has registered an IPM receive callback via ipm_register_callback, the driver’s normal operation path will be triggered.

Affected Systems

This flaw resides in Zephyr Project Zephyr OS, specifically in drivers/ipm/ipm_sedi.c. No specific product version is listed, so any Zephyr build that includes the unchecked code with CONFIG_DEBUG disabled is vulnerable. The issue is relevant to Intel ISH‑based platforms (intel_ish_5_*) where the host controller can write to the IPC doorbell register. Any production image of Zephyr that uses the SEDI IPM driver on such hardware is impacted.

Risk and Exploitability

The CVSS score is 6, indicating medium severity. EPSS is not reported and the CVE is not in the CISA KEV catalog, so the market exploitation probability is unclear. However, the exploit can be performed by any software with driver‑level or raw BAR access to the host’s IPC register window, which is generally privileged on the target device. The flaw does not require external network traffic; it is triggered when an application has registered an IPM receive callback. Because the overflow occurs in interrupt context and corrupts kernel synchronization primitives, successful exploitation can lead to arbitrary kernel memory corruption or a forced system reboot. The lack of a safety check in production images makes this a serious crash primitive.

Generated by OpenCVE AI on September 21, 2026 at 18:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a Zephyr update that rewrites ipm_sedi.c to reject doorbell lengths greater than IPC_DATA_LEN_MAX and logs the event before acknowledging the interrupt.
  • If an update is not available, re‑configure the host CPU’s ISH driver or raw BAR access to ensure it never writes a doorbell length larger than 128 bytes, or disable IPM access from the host side entirely.
  • Enable CONFIG_DEBUG during testing to activate the DBG_CHECK bounds check and verify that your build rejects oversized doorbell messages.
  • Monitor system logs for IPM error messages or unexpected kernel panics that could indicate exploitation attempts.

Generated by OpenCVE AI on September 21, 2026 at 18:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 21 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Description The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-written doorbell register, extracted the payload length with IPC_HEADER_GET_LENGTH(), and passed that length straight to sedi_ipc_read_msg() to copy the message into struct ipm_sedi_context.incoming_data_buf, without checking it against the buffer size. The doorbell length field is 10 bits wide (IPC_HEADER_LENGTH_MASK is 0x03FF), so it can encode up to 1023 bytes, while incoming_data_buf is IPC_DATA_LEN_MAX (128) bytes. The bounds check in the underlying HAL sedi_ipc_read_msg() is a DBG_CHECK that compiles away unless CONFIG_DEBUG is set, so no check remained in a production image. The doorbell register is written by the peer processor on the other side of the IPC link — for the intel_ish_5_* targets, the host CPU's ISH driver, reached through the device's memory-mapped register window. Host-side software with driver-level or raw BAR access can therefore set a length of up to 1023 and cause the interrupt handler to copy far past the destination buffer. The affected path requires an application to have registered an IPM receive callback via ipm_register_callback(), which is the driver's normal mode of use. The result is an out-of-bounds write of up to 895 bytes into static (.bss) memory, performed in interrupt context. The overflow first clobbers the rest of struct ipm_sedi_context — including the k_sem and k_mutex used by the transmit path, whose wait queues contain self-referential list pointers — and then adjacent static data, giving a kernel data-structure corruption and crash primitive. The overflowing bytes are read from registers following the message window, a portion of which are themselves peer-programmable. The fix rejects any doorbell whose encoded length exceeds IPC_DATA_LEN_MAX, logging it and acknowledging the doorbell so the peer is not left waiting.
Title Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-09-21T18:48:52.333Z

Reserved: 2026-07-24T13:31:04.469Z

Link: CVE-2026-17051

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T17:17:34.207

Modified: 2026-09-21T17:17:34.207

Link: CVE-2026-17051

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T18:30:17Z

Weaknesses