Out-of-Bounds Memory Access in EEPROM Simulator Driver of Zephyr Project

CVE-2026-90833

What is CVE-2026-90833?

The EEPROM Simulator Driver within the Zephyr Project contains a flaw allowing unprivileged users to manipulate memory access. Specifically, it fails to validate offset values, enabling attackers to exploit negative offsets in read and write operations. This design flaw leads to out-of-bounds memory reads and writes, compromising kernel memory integrity. The vulnerability emerges from erroneous pointer arithmetic in input validations and can be exploited under specific configurations enabling userspace access. To mitigate this issue, the driver has been updated to reject negative offsets and perform proper limit checks.

References