Out-of-Bounds Write Vulnerability in Xtensa ELF Extensions by Zephyr Project

CVE-2026-12235

What is CVE-2026-12235?

The Xtensa Loadable Extensions subsystem incorrectly manages PLT/RELA relocation entries when linking ELF extensions. This oversight allows for attacker-influenced out-of-bounds writes, potentially leading to memory corruption in supervisor context. The vulnerability arises from insufficient validation of relocation offsets within the ELF's RELA table, exposing systems to risks including integrity loss and sandbox-boundary escapes. The proposed fix implements bound checks to ensure that RELA entries remain within valid limits, enhancing the robustness of the extension loading process.

References