CVE-2026-10677
- Source
- https://cve.org/CVERecord?id=CVE-2026-10677
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10677.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-10677
- Aliases
-
- GHSA-r3cc-8wcr-xfj9
- Published
- 2026-07-21T21:30:54.690Z
- Modified
- 2026-07-24T04:01:22.004006453Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVSS Calculator
- Summary
- Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool
- Details
-
The CONFIGUSERSPACE syscall verifier zvrfykpoll() in kernel/poll.c allocates a kernel-side copy of the user-supplied kpollevent[] via zthreadmalloc() and then validates each event's object handle. Before this fix, validation used KOOPS(KSYSCALLOBJ(...)) inline inside the loop, which kills the calling thread without freeing eventscopy.
A user thread can pass numevents >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resourcepool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (kqueue alloc nodes, kmsgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service.
The fix replaces each inline KOOPS with a conditional goto oopsfree so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.
- Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "introduced": "1.12.0" }, { "fixed": "4.5.0" } ], "source": "AFFECTED_FIELD" } ], "cwe_ids": [ "CWE-401" ], "cna_assigner": "zephyr", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10677.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10677.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r3cc-8wcr-xfj9
- https://nvd.nist.gov/vuln/detail/CVE-2026-10677
- https://github.com/zephyrproject-rtos/zephyr/commit/8dc7a37bc75402a0a3329397887f32f5fb4da3ad
- https://github.com/zephyrproject-rtos/zephyr