CVE-2026-11743

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11743
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11743.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11743
Aliases
  • GHSA-c6wh-gwg4-fj5j
Published
2026-08-07T21:10:23.470Z
Modified
2026-08-10T08:05:08.776854Z
Severity
  • 6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
Summary
Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write
Details

The SF32LB MPI QSPI NOR flash driver (drivers/flash/flashsf32lbmpiqspinor.c) validated the flash offset and length on its read and write paths with the test (offset + size) > data->size. Because offset is a signed off_t while size is unsigned, a negative offset is converted to a large unsigned value and the addition can wrap to a small result that passes the check. The read path then performs memcpy(dst, (void *)(data->base + offset), size) and the write path programs flash at offset and cache-invalidates data->base + offset, in both cases accessing memory outside the mapped flash window. The driver's erase path already rejected negative offsets, but read and write did not.

In builds with CONFIGUSERSPACE, flashread and flash_write are syscalls whose verifiers validate the device object and the caller's buffer but deliberately delegate offset bounds checking to the driver. An unprivileged thread that has been granted access to this flash device can therefore call the syscall with a crafted negative offset and a buffer valid in its own memory domain, and reach the unchecked access.

The most direct impact is on the read path: by choosing a negative offset and matching size, an attacker slides the memcpy source below the flash base and copies arbitrary CPU-addressable memory into its own buffer, disclosing memory it is not authorized to read. The write path additionally allows programming flash at an out-of-range address and invalidating an attacker-chosen cache range, affecting integrity and availability. Reachability requires userspace to be enabled and the raw flash device object to be granted to an untrusted thread.

The fix replaces the check with qspinorrangeisvalid(), which rejects negative offsets and performs the bound comparison in overflow-safe 64-bit arithmetic on both paths, and additionally adds an SRAM DMA bounce buffer plus source/destination overlap rejection to prevent a separate DMA bus-hang condition.

Database specific 
{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11743.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
3568e1b6d5cdd51a6b964a2a1d6d29200fea2056
Fixed
909eb568750304d68ea481d1b56a489ae670bdae
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.3.0"
        },
        {
            "fixed": "4.4.2"
        }
    ]
}

Affected versions

v4.*
v4.3.0
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3

Database specific

vanir_signatures_modified 
"2026-08-10T08:05:08Z"
vanir_signatures 
[
    {
        "target": {
            "function": "flash_sf32lb_mpi_qspi_nor_write",
            "file": "drivers/flash/flash_sf32lb_mpi_qspi_nor.c"
        },
        "digest": {
            "length": 1374.0,
            "function_hash": "258238701242427710380206109171505510430"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-11743-1d91c08b",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/909eb568750304d68ea481d1b56a489ae670bdae"
    },
    {
        "target": {
            "file": "drivers/flash/flash_sf32lb_mpi_qspi_nor.c"
        },
        "digest": {
            "line_hashes": [
                "6108438872594112969852534066282890094",
                "64832925422701372260293177879192618503",
                "286883898100447970256662933976720744800",
                "258868390413530799789402690037875268230",
                "66946682715816547556180182059412406038",
                "121993672288701567913468387213126786771",
                "42619639886194961463879648952390528364",
                "199215630996211865062471389822358019545",
                "199709067282365133175601848612817095141",
                "146200264986420203611184607344591379463",
                "337759381951119799247492321058917869937",
                "73355214681409605896951806350590179387",
                "18724503937575915285310467816273984093",
                "335700885848070661877585662327706391275",
                "117983663539348737902718381618985204251",
                "48060085421842233797253054631584627138",
                "37998928427158035278754912127977806802",
                "225530821323255279814676516135615152452",
                "194374465953113951382817008943998655297",
                "9646970469909644110443284626850764157",
                "54337089906814512316915391275976209623",
                "148031167237325942270344577858414193805",
                "213366578255799545843114199332486133067",
                "93694855304045203836456376011507476102",
                "97393411043365663430774249425213262043",
                "69096242604075602520508513027366156510",
                "78561230713338662297580746665262494193",
                "3358970461195239381783578600972355901",
                "268990597337866257773940470845225154403",
                "324853570788997254269081687817563905681",
                "166488122375434522194851506087875355635"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-11743-78569ef9",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/909eb568750304d68ea481d1b56a489ae670bdae"
    },
    {
        "target": {
            "function": "flash_sf32lb_mpi_qspi_nor_read",
            "file": "drivers/flash/flash_sf32lb_mpi_qspi_nor.c"
        },
        "digest": {
            "length": 262.0,
            "function_hash": "253716324693513665259529638448991518519"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-11743-d9884bee",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/909eb568750304d68ea481d1b56a489ae670bdae"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11743.json"