CVE-2026-17051 zephyrproject CVE debrief

Who should care

Defenders of systems using the Intel SEDI IPM driver in Zephyr should assess exposure and prioritize patching. The vulnerability allows an attacker with driver-level or raw BAR access to cause a kernel data-structure corruption and crash primitive.

Why it matters

The Intel SEDI IPM driver in Zephyr has an out-of-bounds write vulnerability, allowing an attacker with driver-level or raw BAR access to cause a kernel data-structure corruption and crash primitive. Defenders should assess exposure and prioritize patching.

• Kernel data-structure corruption
• Crash primitive for adjacent static data
• Potential for denial-of-service
• Requires verification of affected versions and remediation

Technical summary

The Intel SEDI IPM driver in Zephyr has an out-of-bounds write vulnerability. The driver handles an inbound message interrupt in ipm_event_dispose(), reading the peer-written doorbell register and extracting the payload length with IPC_HEADER_GET_LENGTH(). The length is passed to sedi_ipc_read_msg() to copy the message into struct ipm_sedi_context.incoming_data_buf without checking it against the buffer size. The doorbell length field is 10 bits wide, encoding up to 1023 bytes, while incoming_data_buf is 128 bytes. The bounds check in sedi_ipc_read_msg() is a DBG_CHECK that compiles away unless CONFIG_DEBUG is set, leaving no check in a production image.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch from the Zephyr project
• Restrict access to the device's memory-mapped register window
• Monitor for suspicious activity on the IPC link
• Verify affected versions and assess exposure
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review asset inventory for potential exposure

Evidence notes

The vulnerability is caused by the Intel SEDI IPM driver not checking the payload length of the inbound message interrupt against the buffer size, allowing an out-of-bounds write into static memory. The doorbell register is written by the peer processor on the other side of the IPC link, and host-side software with driver-level or raw BAR access can set a length of up to 1023 bytes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.