Thread Index Allocation Flaw in Zephyr's Userspace Dynamic Objects

CVE-2026-10681

What is CVE-2026-10681?

The vulnerability allows two user-mode threads on SMP systems to concurrently allocate the same thread permission index, leading to aliasing within a kernel object's access control list. This flaw undermines the isolation of user space access controls, as a grant of access to one thread can unwittingly grant the same access to another. The issue originates from improper locking mechanisms during thread index allocation routines, permitting unauthorized access and potential privilege escalation within the system. A fix has been introduced to ensure proper locking during the allocation process, as outlined in the project's commit history.

References