CVE-2026-10681 zephyrproject CVE debrief

Who should care

Users of Zephyr's userspace dynamic-objects subsystem, especially those with SMP systems and CONFIG_USERSPACE, CONFIG_DYNAMIC_OBJECTS, and CONFIG_SMP enabled, should review their configurations and update to Zephyr version v4.4.1 or later. Affected operators, platforms, vulnerability-management teams, and security teams should prioritize patching and review compensating controls for exposed systems.

Technical summary

In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index from the global _thread_idx_map[] bitmap without holding lists_lock. On SMP systems, two user-mode threads invoking the k_object_alloc(K_OBJ_THREAD) syscall concurrently can both observe the same low free bit, perform the same non-atomic RMW to clear it, and return the identical tidx. The two newly created K_OBJ_THREAD objects are then assigned the same thread_id, so the two user threads alias a single bit position in every kernel object's perms[] bitfield: any subsequent grant of access on a kernel object to one thread is implicitly a grant to the other, defeating userspace ACL isolation. A secondary lost-update window between the unlocked &=~BIT() in alloc and the locked |= BIT() in thread_idx_free() can also leak entries from the thread-index pool.

Defensive priority

Medium

Recommended defensive actions

• Apply the official patch or update to Zephyr version v4.4.1 or later
• Review and update CONFIG_USERSPACE, CONFIG_DYNAMIC_OBJECTS, and CONFIG_SMP configurations
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-25T14:16:28.957Z and has not been modified since then. The NVD entry is currently 6.5 (MEDIUM). Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and review vendor guidance for specific configurations and mitigations.

Official resources