CVE-2026-10677 Details
Description
The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy. A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service. The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.
A denial-of-service vulnerability has been identified in the Zephyr kernel's `k_poll` syscall verifier, `z_vrfy_k_poll()`, in versions 1.12.0 through 4.4.1. The vulnerability arises from the function's handling of user-supplied `k_poll_event[]` arrays. When a user thread sends events with forged object handles, the function allocates memory for these events but fails to properly validate the handles before freeing the memory. This oversight allows an attacker to exploit the vulnerability by leaking the allocated memory, which is not automatically reclaimed when the thread is terminated. The leaked memory depletes the shared kernel heap, leading to failures in legitimate kernel allocations and causing a system-level denial-of-service condition.
Users can upgrade to Zephyr version 4.5.0 or later, where this vulnerability has been fixed. Instructions for updating can be found in the Zephyr project's documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zephyrproject zephyr | >= 1.12.0, <= 4.4.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |