Kernel Memory Corruption in Zephyr OS Due to Improper Input Validation

CVE-2026-10682

What is CVE-2026-10682?

A signed comparison flaw in the userspace verifier function of Zephyr OS allows negative values for the src_id parameter to bypass validation checks. This vulnerability leads to out-of-bounds memory accesses and potential kernel memory corruption, enabling privilege escalation when exploited. The issue arises from an improper type conversion which permits an attacker to manipulate memory adjacent to a sensitive log section. The defect affects all builds configured with user space and runtime filtering enabled, requiring updates to mitigate the risks associated with this input validation error.

References