FKIE_CVE-2026-10669
Vulnerability from fkie_nvd - Published: 2026-07-14 15:16 - Updated: 2026-10-24 21:10
Severity
Summary
On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return value to 0 (access permitted) and only set a denial result inside its per-MPU-region probe loop. When the rounded extent of the buffer wraps the 32-bit address space (size + alignment offset near SIZE_MAX, or ROUND_UP(size + offset) overflowing to 0), the loop executes zero iterations and the function returns 0 = permitted without probing any MPU region.
The syscall-layer pre-checks (K_SYSCALL_MEMORY_SIZE_CHECK / Z_DETECT_POINTER_OVERFLOW) only catch a raw addr+size wrap and do not cover the ROUND_UP-induced wrap, and the string path (arch_user_string_nlen -> arch_buffer_validate) has no syscall-layer guard at all.
An unprivileged user-mode thread can therefore pass a crafted (addr, size) to any syscall that validates user buffers via k_usermode_from_copy/to_copy or k_usermode_string_copy and have validation succeed for memory it must not access; the kernel then reads from (disclosure) or, with write=1, writes to (corruption) attacker-chosen kernel or other-partition memory on the thread's behalf, enabling information disclosure, memory corruption, privilege escalation, and denial of service.
Affected from v3.7.0 (when Xtensa MPU userspace support was added) through v4.4.0. The fix changes the default to -EINVAL (deny by default), adds an explicit size_add_overflow check, and sets the success value only after the full range has been validated.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| zephyrproject | zephyr | * |
{
"affected": [
{
"affectedData": [
{
"collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
"defaultStatus": "unaffected",
"packageName": "zephyr",
"product": "zephyr",
"programFiles": [
"arch/xtensa/core/mpu.c"
],
"vendor": "zephyrproject",
"versions": [
{
"lessThan": "4.3.1",
"status": "affected",
"version": "3.7.0",
"versionType": "semver"
},
{
"lessThan": "4.4.1",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
}
],
"source": "vulnerabilities@zephyrproject.org"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9F648F66-9415-47A6-92AD-4C61A70269B2",
"versionEndExcluding": "4.5.0",
"versionStartIncluding": "3.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c \u2014 the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission \u2014 defaulted its return value to 0 (access permitted) and only set a denial result inside its per-MPU-region probe loop. When the rounded extent of the buffer wraps the 32-bit address space (size + alignment offset near SIZE_MAX, or ROUND_UP(size + offset) overflowing to 0), the loop executes zero iterations and the function returns 0 = permitted without probing any MPU region.\n\nThe syscall-layer pre-checks (K_SYSCALL_MEMORY_SIZE_CHECK / Z_DETECT_POINTER_OVERFLOW) only catch a raw addr+size wrap and do not cover the ROUND_UP-induced wrap, and the string path (arch_user_string_nlen -\u003e arch_buffer_validate) has no syscall-layer guard at all.\n\nAn unprivileged user-mode thread can therefore pass a crafted (addr, size) to any syscall that validates user buffers via k_usermode_from_copy/to_copy or k_usermode_string_copy and have validation succeed for memory it must not access; the kernel then reads from (disclosure) or, with write=1, writes to (corruption) attacker-chosen kernel or other-partition memory on the thread\u0027s behalf, enabling information disclosure, memory corruption, privilege escalation, and denial of service.\n\nAffected from v3.7.0 (when Xtensa MPU userspace support was added) through v4.4.0. The fix changes the default to -EINVAL (deny by default), adds an explicit size_add_overflow check, and sets the success value only after the full range has been validated."
},
{
"lang": "es",
"value": "En SoCs Xtensa construidos con CONFIG_XTENSA_MPU y CONFIG_USERSPACE, arch_buffer_validate() en arch/xtensa/core/mpu.c - el \u2019hook\u2019 de arquitectura que verifica que un b\u00fafer proporcionado por el modo de usuario sea accesible para el hilo de usuario llamante con el permiso solicitado - establec\u00eda por defecto su valor de retorno en 0 (acceso permitido) y solo establec\u00eda un resultado de denegaci\u00f3n dentro de su bucle de sondeo por regi\u00f3n MPU. Cuando la extensi\u00f3n redondeada del b\u00fafer envuelve el espacio de direcciones de 32 bits (size + desplazamiento de alineaci\u00f3n cerca de SIZE_MAX, o ROUND_UP(size + offset) desbord\u00e1ndose a 0), el bucle ejecuta cero iteraciones y la funci\u00f3n devuelve 0 = permitido sin sondear ninguna regi\u00f3n MPU.\n\nLas comprobaciones previas de la capa de llamadas al sistema (K_SYSCALL_MEMORY_SIZE_CHECK / Z_DETECT_POINTER_OVERFLOW) solo detectan un \u2019wrap\u2019 de addr+size en bruto y no cubren el \u2019wrap\u2019 inducido por ROUND_UP, y la ruta de cadena (arch_user_string_nlen -\u003e arch_buffer_validate) no tiene ninguna protecci\u00f3n a nivel de capa de llamadas al sistema.\n\nUn hilo de modo de usuario sin privilegios puede, por lo tanto, pasar un (addr, size) manipulado a cualquier llamada al sistema que valide b\u00faferes de usuario a trav\u00e9s de k_usermode_from_copy/to_copy o k_usermode_string_copy y lograr que la validaci\u00f3n tenga \u00e9xito para memoria a la que no debe acceder; el kernel entonces lee de (revelaci\u00f3n) o, con write=1, escribe en (corrupci\u00f3n) memoria del kernel o de otra partici\u00f3n elegida por el atacante en nombre del hilo, lo que permite la revelaci\u00f3n de informaci\u00f3n, la corrupci\u00f3n de memoria, la escalada de privilegios y la denegaci\u00f3n de servicio.\n\nAfectado desde la v3.7.0 (cuando se a\u00f1adi\u00f3 el soporte de espacio de usuario de Xtensa MPU) hasta la v4.4.0. La soluci\u00f3n cambia el valor predeterminado a -EINVAL (denegar por defecto), a\u00f1ade una comprobaci\u00f3n expl\u00edcita de size_add_overflow y establece el valor de \u00e9xito solo despu\u00e9s de que se haya validado el rango completo."
}
],
"id": "CVE-2026-10669",
"lastModified": "2026-10-24T21:10:00.130",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "vulnerabilities@zephyrproject.org",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-10669",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T15:30:37.607534Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-14T15:16:55.210",
"references": [
{
"source": "vulnerabilities@zephyrproject.org",
"tags": [
"Patch"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/commit/3b1bdaf5482188ca110ef9a411aaa8c7d3db3b16"
},
{
"source": "vulnerabilities@zephyrproject.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4r4p-gh69-v6w4"
}
],
"sourceIdentifier": "vulnerabilities@zephyrproject.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "vulnerabilities@zephyrproject.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-190"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.