CVE-2026-10667
- Source
- https://cve.org/CVERecord?id=CVE-2026-10667
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10667.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-10667
- Aliases
-
- GHSA-9x5j-h3rh-x579
- Published
- 2026-07-12T16:16:50Z
- Modified
- 2026-10-28T11:04:04Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads
- Details
-
Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated kernel objects. Iteration over this list in k_object_wordlist_foreach() was performed under lists_lock using the SAFE iterator (which caches the next node), but list removal and freeing of nodes was performed under different, disjoint spinlocks: objfree_lock in k_object_free() and obj_lock in unref_check(). On an SMP system, while one CPU iterated obj_list under lists_lock, another CPU could unlink and k_free() the dyn_obj node that the iterator had cached as its next pointer, causing the iterator to dereference freed kernel memory (use-after-free / dangling list traversal). All of the racing operations are reachable from unprivileged user-mode threads via system calls: k_object_alloc/k_object_alloc_size and k_object_release drive removals through unref_check() (under obj_lock), while k_thread_abort and thread creation drive the iteration through k_thread_perms_all_clear()/k_thread_perms_inherit() (under lists_lock). A deprivileged user thread on a CONFIG_SMP + CONFIG_USERSPACE build can therefore corrupt the kernel's object-tracking structures across the userspace security boundary, yielding kernel memory corruption (potential privilege escalation) or a kernel crash (denial of service). The fix removes objfree_lock and serializes every obj_list modification under lists_lock, including holding it across find+remove in k_object_free() and around unref_check() in k_thread_perms_clear(). Affects CONFIG_SMP+CONFIG_USERSPACE+CONFIG_DYNAMIC_OBJECTS configurations; the defect dates to the 2019 spinlockification (commit 8a3d57b6cc6, first released in v1.14.0) and shipped through v4.4.0.
- Database specific
{ "cna_assigner": "zephyr", "cwe_ids": [ "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10667.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10667.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9x5j-h3rh-x579
- https://nvd.nist.gov/vuln/detail/CVE-2026-10667
- https://github.com/zephyrproject-rtos/zephyr/commit/fdc42fa256b8c2a7b27790f032d5385f8058c4a9
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected ranges
- Type
- GIT
- Repo
- https://github.com/zephyrproject-rtos/zephyr
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.14.0" }, { "fixed": "4.3.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "4.4.0" }, { "fixed": "4.4.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "fdc42fa256b8c2a7b27790f032d5385f8058c4a9" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
v1.*
v2.*
v3.*
v4.*
zephyr-v1.*
zephyr-v2.*
zephyr-v3.*
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10667.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "62765004902892148599119951816394802176",
"length": 679
},
"id": "CVE-2026-10667-142413a2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/fdc42fa256b8c2a7b27790f032d5385f8058c4a9",
"target": {
"file": "kernel/userspace/userspace.c",
"function": "k_object_free"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "54859156481588953866132327058746756257",
"length": 293
},
"id": "CVE-2026-10667-1c83b849",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/fdc42fa256b8c2a7b27790f032d5385f8058c4a9",
"target": {
"file": "kernel/userspace/userspace.c",
"function": "dyn_object_find"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"57206462347315156752614330879731307384",
"116735794918953133551661736235430589754",
"336519830309302715198564050254540214186",
"20478165294436548079898738466039715384",
"231547027643455582615857069927783398737",
"248440342336805057923636264316201960632",
"65789584085877112583269559274771924845",
"168727794949148730183703503177837438031",
"294603618380401343628601761285266092876",
"142520753813033794478047834027210879432",
"282564881980687345020327462692056460184",
"63810264452508075619746747826537432989",
"304197222887526416427476698266360513135",
"204449480136065185915133713665103492010",
"154889568089249760226880036582394220619",
"280296868698093106432126092465966832962",
"21965055376877067093168682943256875025",
"2463960855284254320027693776637781721",
"153464301064071304812194500383598842741",
"224571708106545307522746558428044386379",
"72184106082404262671074603057978946112",
"306749432598499154590758689868348410182",
"272016893456181173014448227429699603129",
"183747301907357271867525779998463189495",
"299198732187375291586521848760270655240",
"145843595384972258779587700718591106524",
"250996281540803681879280445528228849118",
"251958014746030475137730722115026102794",
"289919108444687956784421761401373618014",
"84464108901064288882258435286880929680",
"333668436262103493641309720862670293124",
"256121023087690004946508411196515285484",
"315132340698946701880957697040126485179",
"137857287443642203439268710561649190123",
"8561494206782132037139847017721157325",
"63342094660890383798819552918246266457",
"107751340062296251292320511246840666706",
"184986516886872908371996809491206412367",
"174161670471600709198542878445293383851",
"89269969695946863028159434069615452924",
"127306674045452790572486025028777704048",
"326631817517170363707970347514953591208",
"199131196848258010460036098333881887336",
"201772278352996036064049411226859117244",
"288345171260011963318422680739893507087",
"159666260694046103138647627160774271628",
"27679969034979954913871467529377604275"
],
"threshold": 0.9
},
"id": "CVE-2026-10667-58420e69",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/fdc42fa256b8c2a7b27790f032d5385f8058c4a9",
"target": {
"file": "kernel/userspace/userspace.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "138565310070426661692408839228264979205",
"length": 251
},
"id": "CVE-2026-10667-8133dc36",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/fdc42fa256b8c2a7b27790f032d5385f8058c4a9",
"target": {
"file": "kernel/userspace/userspace.c",
"function": "thread_idx_free"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "118271114604210994574700762827528235276",
"length": 182
},
"id": "CVE-2026-10667-9a3a8fdd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/fdc42fa256b8c2a7b27790f032d5385f8058c4a9",
"target": {
"file": "kernel/userspace/userspace.c",
"function": "k_thread_perms_clear"
}
}
]
vanir_signatures_modified
"2026-10-28T11:04:04Z"