CVE-2026-12235

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-12235
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12235.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-12235
Aliases
  • GHSA-xv9q-6mrf-8j49
Published
2026-08-12T04:55:15.620Z
Modified
2026-08-14T09:05:48.071461Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)
Details

The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llextlinkplt() (subsys/llext/llextlink.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXTMEMTEXT] - text.shoffset + rela.roffset + tgt->shoffset and then performed the relocation write there without validating rela.roffset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llextfile_offset().

rela.roffset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via roffset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs.

The path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial.

The fix adds a bound check rejecting any RELA entry whose roffset >= tgt->shsize, mirroring the existing validation in the shared branch.

Database specific 
{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12235.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
36940db938a8f4a1e919496793ed439850a221c2
Fixed
106540afbd22087ad40b90f53fb22657754a719e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.7.0"
        },
        {
            "fixed": "4.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.7.0
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12235.json"
vanir_signatures 
[
    {
        "target": {
            "function": "llext_link_plt",
            "file": "subsys/llext/llext_link.c"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/106540afbd22087ad40b90f53fb22657754a719e",
        "id": "CVE-2026-12235-6d587d19",
        "signature_version": "v1",
        "digest": {
            "length": 2870.0,
            "function_hash": "113292722997919077728948479242605722341"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "subsys/llext/llext_link.c"
        },
        "deprecated": false,
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/106540afbd22087ad40b90f53fb22657754a719e",
        "id": "CVE-2026-12235-e3e69016",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "104093657600737211811312920324316877613",
                "275060079479860757930027242392016029972",
                "20577632894537155701062780061802078652",
                "300967193320644165986352140264335323607",
                "227798336776120057627615307105696390120",
                "54776370691421580850233073303381474240",
                "220709915079258230827793601824159739993",
                "184792604639254598134778438655925917921",
                "201561984211959582624779422042619552289",
                "170023150180655828589399639296434243355",
                "232988519097173838809793431136139896846",
                "158174359383958421328426391981069252407",
                "273617652213560345199276186379607160131",
                "220929425614529506416643782156558507188",
                "185943400793034324873219271403908770762",
                "92313287457520890740747739921129787936",
                "282113568989849375466202570209284531036",
                "141855325836174787780417854245375785386",
                "296798628537328967344166023364600449436",
                "107793931771149914453017227735289949460"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-14T09:05:48Z"