PatchSiren cyber security CVE debrief
CVE-2026-10677 zephyrproject CVE debrief
A medium-severity vulnerability, CVE-2026-10677, was found in the Zephyr kernel's CONFIG_USERSPACE syscall verifier z_vrfy_k_poll(). The vulnerability allows a user thread to pass a forged object handle, leading to a kernel memory leak. This leak can be repeated by spawning sacrificial threads until the shared kernel heap is exhausted, causing legitimate kernel allocations to fail and resulting in a system-level denial of service. The vulnerability affects Zephyr releases from v1.12.0 through v4.4.1. Users and administrators of Zephyr-based systems should be aware of this vulnerability and take steps to mitigate it.
- Vendor
- zephyrproject
- Product
- zephyr
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Users and administrators of Zephyr-based systems, particularly those using versions between v1.12.0 and v4.4.1, should be aware of this vulnerability and take steps to mitigate it. Operators and security teams should review the vulnerability and assess the potential impact on their systems. Vulnerability management teams should prioritize patching or mitigating the vulnerability.
Technical summary
The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before the fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy. A user thread can pass num_events >= 1 with a forged object handle to leak the allocation. The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed.
Defensive priority
High
Recommended defensive actions
- Apply the official patch or upgrade to a fixed version of Zephyr
- Review and update Zephyr configurations to ensure CONFIG_USERSPACE is properly set
- Monitor system resources for signs of memory exhaustion
- Implement compensating controls, such as limiting the number of user threads
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
Evidence notes
The CVE record was published on 2026-07-21T22:16:59.923Z and was last modified on 2026-07-22T20:16:42.383Z. The NVD entry is currently Undergoing Analysis. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability affects Zephyr releases from v1.12.0 through v4.4.1.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:16:59.923Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.