CVE-2026-10677
- Source
- https://cve.org/CVERecord?id=CVE-2026-10677
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10677.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-10677
- Aliases
-
- GHSA-r3cc-8wcr-xfj9
- Published
- 2026-07-21T21:30:54Z
- Modified
- 2026-11-05T08:04:26Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVSS Calculator
- Summary
- Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool
- Details
-
The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy.
A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service.
The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.
- Database specific
{ "cna_assigner": "zephyr", "cwe_ids": [ "CWE-401" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10677.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10677.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r3cc-8wcr-xfj9
- https://nvd.nist.gov/vuln/detail/CVE-2026-10677
- https://github.com/zephyrproject-rtos/zephyr/commit/8dc7a37bc75402a0a3329397887f32f5fb4da3ad
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected ranges
- Type
- GIT
- Repo
- https://github.com/zephyrproject-rtos/zephyr
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.12.0" }, { "fixed": "4.3.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "4.4.0" }, { "fixed": "4.4.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "8dc7a37bc75402a0a3329397887f32f5fb4da3ad" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
v1.*
v1.12.0
v1.13.0
v1.13.0-rc1
v1.13.0-rc2
v1.13.0-rc3
v1.14.0
v1.14.0-rc1
v1.14.0-rc2
v1.14.0-rc3
v2.*
v2.0.0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.1.0
v2.1.0-rc1
v2.1.0-rc2
v2.1.0-rc3
v2.2.0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.3.0
v2.3.0-rc1
v2.3.0-rc2
v2.4.0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.5.0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.5.0-rc4
v2.6.0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.7.99
v3.*
v3.0.0
v3.0.0-rc1
v3.0.0-rc2
v3.0.0-rc3
v3.1.0
v3.1.0-rc1
v3.1.0-rc2
v3.1.0-rc3
v3.2.0
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.3.0-rc3
v3.4.0
v3.4.0-rc1
v3.4.0-rc2
v3.4.0-rc3
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.5.0-rc3
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.3.1-rc1
v4.4.0
v4.4.1
v4.4.1-rc1
v4.4.2-rc1
zephyr-v1.*
zephyr-v1.12.0
zephyr-v1.13.0
zephyr-v1.14.0
zephyr-v2.*
zephyr-v2.0.0
zephyr-v2.1.0
zephyr-v2.2.0
zephyr-v2.3.0
zephyr-v2.4.0
zephyr-v2.5.0
zephyr-v2.6.0
zephyr-v3.*
zephyr-v3.0.0
zephyr-v3.1.0
zephyr-v3.2.0
zephyr-v3.3.0
zephyr-v3.4.0
zephyr-v3.5.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10677.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "254972498038870246360918444116104506371",
"length": 1502
},
"id": "CVE-2026-10677-4aa738b9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/8dc7a37bc75402a0a3329397887f32f5fb4da3ad",
"target": {
"file": "kernel/poll.c",
"function": "z_vrfy_k_poll"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"50207683876053897450814244935199346572",
"267275315882934701780153964521888966020",
"85685743785461927747896785727207631101",
"312853238007902623061533608806370559721",
"158857032001479221579518635655920675376",
"117783183809272337662628354532431372385",
"325592623786711882175831055514186355361",
"57332128823508572493149184769344555699",
"273046357105971927558688360355367986839",
"125876141163649386231390968236630570536",
"292107320573748149248574643681696372830",
"130993145525159827603907475839907725929",
"154691133355004823516360661436345240410",
"180689098186007915052937476970745134479",
"334800654998351726167561502937701591737",
"335629426297155321226933412748831535146"
],
"threshold": 0.9
},
"id": "CVE-2026-10677-cd4935e4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/8dc7a37bc75402a0a3329397887f32f5fb4da3ad",
"target": {
"file": "kernel/poll.c"
}
}
]
vanir_signatures_modified
"2026-11-05T08:04:26Z"