Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-401.
Summary
The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy. A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service. The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zephyrproject | zephyr | 1.12.0 to before 4.3.1; 4.4.0 to before 4.4.2 | 4.3.1, 4.4.2 | Patch available | CNA |
- zephyr Vendorzephyrproject Affected 1.12.0 to before 4.3.1; 4.4.0 to before 4.4.2 Fixed in 4.3.1, 4.4.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* | 1.12.0 – 4.4.1 | Vulnerable | zephyrproject |
- cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* Versions 1.12.0 – 4.4.1 Vulnerable ·zephyrproject
Remediation
- Fix · CNA zephyr (zephyrproject) Fixed in 4.3.1, 4.4.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
zephyrproject zephyr 4.3.1, 4.4.2
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2026-09181 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflowPriority LOW 34
- TI-2026-09177 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)Priority LOW 29
- TI-2026-09180 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)Priority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10677
- 2026-10-16 Fix available: [email protected], [email protected] · CNA
References
More zephyrproject Zephyr vulnerabilities
- TI-2026-04422 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key CVSS 3.1CRITICAL 9.8
- TI-2026-01361 dns: memory‑safety issue in the DNS name parser CVSS 3.1CRITICAL 9.8
- TI-2026-09174 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) CVSS 3.1CRITICAL 9.1
- TI-2026-09168 Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c` CVSS 3.1CRITICAL 9.8
- TI-2024-09625 net: lib: http_server: Buffer Under-read CVSS 3.1HIGH 8.6
- TI-2021-02863 Usb bluetooth device ACL read cb buffer overflow CVSS 3.1CRITICAL 9.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences