User Space System Call Vulnerability in Zephyr RTOS by Zephyr Project

CVE-2026-12234

What is CVE-2026-12234?

This vulnerability arises from flaws in the syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in Zephyr RTOS. These functions improperly handle user-supplied data, allowing a race condition that could lead to out-of-bounds memory access. By inflating the msg->msg_iovlen value through a cooperating thread in the same memory domain, an attacker can exploit this timing issue to write harmful values beyond the allocated kernel-heap shadow buffer. This flaw not only opens the door for local privilege escalation but may also result in kernel fault denial of service. The proposed fix implements atomic copying of the header, ensuring that all sizes and boundaries are derived from a single snapshot to mitigate the risks associated with this vulnerability.

References