CVE-2026-10667

{"id": "CVE-2026-10667", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10667", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-13T15:49:41.562734Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "1.14.0", "lessThan": "4.3.1", "versionType": "semver"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["kernel/userspace/userspace.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-07-12T17:16:24.670", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/fdc42fa256b8c2a7b27790f032d5385f8058c4a9", "tags": ["Patch"], "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9x5j-h3rh-x579", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9x5j-h3rh-x579", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated kernel objects. Iteration over this list in k_object_wordlist_foreach() was performed under lists_lock using the SAFE iterator (which caches the next node), but list removal and freeing of nodes was performed under different, disjoint spinlocks: objfree_lock in k_object_free() and obj_lock in unref_check(). On an SMP system, while one CPU iterated obj_list under lists_lock, another CPU could unlink and k_free() the dyn_obj node that the iterator had cached as its next pointer, causing the iterator to dereference freed kernel memory (use-after-free / dangling list traversal). All of the racing operations are reachable from unprivileged user-mode threads via system calls: k_object_alloc/k_object_alloc_size and k_object_release drive removals through unref_check() (under obj_lock), while k_thread_abort and thread creation drive the iteration through k_thread_perms_all_clear()/k_thread_perms_inherit() (under lists_lock). A deprivileged user thread on a CONFIG_SMP + CONFIG_USERSPACE build can therefore corrupt the kernel's object-tracking structures across the userspace security boundary, yielding kernel memory corruption (potential privilege escalation) or a kernel crash (denial of service). The fix removes objfree_lock and serializes every obj_list modification under lists_lock, including holding it across find+remove in k_object_free() and around unref_check() in k_thread_perms_clear(). Affects CONFIG_SMP+CONFIG_USERSPACE+CONFIG_DYNAMIC_OBJECTS configurations; the defect dates to the 2019 spinlockification (commit 8a3d57b6cc6, first released in v1.14.0) and shipped through v4.4.0."}, {"lang": "es", "value": "El seguimiento din\u00e1mico de objetos del kernel de Zephyr (kernel/userspace/userspace.c, anteriormente kernel/userspace.c) mantiene una lista doblemente enlazada (obj_list) de objetos del kernel asignados din\u00e1micamente. La iteraci\u00f3n sobre esta lista en k_object_wordlist_foreach() se realizaba bajo lists_lock usando el iterador SAFE (que almacena en cach\u00e9 el siguiente nodo), pero la eliminaci\u00f3n de la lista y la liberaci\u00f3n de nodos se realizaban bajo diferentes spinlocks disjuntos: objfree_lock en k_object_free() y obj_lock en unref_check(). En un sistema SMP, mientras una CPU iteraba obj_list bajo lists_lock, otra CPU pod\u00eda desenlazar y k_free() el nodo dyn_obj que el iterador hab\u00eda almacenado en cach\u00e9 como su puntero siguiente, haciendo que el iterador desreferenciara memoria del kernel liberada (uso despu\u00e9s de liberaci\u00f3n / recorrido de lista colgante). Todas las operaciones de carrera son accesibles desde hilos de modo de usuario sin privilegios a trav\u00e9s de llamadas al sistema: k_object_alloc/k_object_alloc_size y k_object_release impulsan las eliminaciones a trav\u00e9s de unref_check() (bajo obj_lock), mientras que k_thread_abort y la creaci\u00f3n de hilos impulsan la iteraci\u00f3n a trav\u00e9s de k_thread_perms_all_clear()/k_thread_perms_inherit() (bajo lists_lock). Un hilo de usuario desprivilegiado en una compilaci\u00f3n CONFIG_SMP + CONFIG_USERSPACE puede, por lo tanto, corromper las estructuras de seguimiento de objetos del kernel a trav\u00e9s del l\u00edmite de seguridad del espacio de usuario, lo que resulta en corrupci\u00f3n de memoria del kernel (potencial escalada de privilegios) o un fallo del kernel (denegaci\u00f3n de servicio). La soluci\u00f3n elimina objfree_lock y serializa cada modificaci\u00f3n de obj_list bajo lists_lock, incluyendo mantenerlo durante la b\u00fasqueda+eliminaci\u00f3n en k_object_free() y alrededor de unref_check() en k_thread_perms_clear(). Afecta a las configuraciones CONFIG_SMP+CONFIG_USERSPACE+CONFIG_DYNAMIC_OBJECTS; el defecto data de la \u2019spinlockificaci\u00f3n\u2019 de 2019 (commit 8a3d57b6cc6, lanzado por primera vez en v1.14.0) y se distribuy\u00f3 hasta v4.4.0."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DE6EBF0-408C-45ED-9CC9-79EF99E3DFDD", "versionEndIncluding": "4.4.1", "versionStartIncluding": "1.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilities@zephyrproject.org"}