Zephyr kernel: Integer overflow in dynamic kernel object allocation
Summary
The dynamic kernel object allocation in the Zephyr kernel does not check the size argument for integer overflow when CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS are enabled. A user-mode thread can request a size that wraps, so the kernel allocates a heap chunk much smaller than the object it then initializes. This allows an out-of-bounds write into the kernel resource-pool heap, which can corrupt kernel memory and may lead to escape from the user-mode sandbox. An attacker needs local code execution as a user-mode thread with low privileges.
Affected
- Zephyr 3.5.0 to 4.4.2
- Requires CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS (or CONFIG_DYNAMIC_THREAD) and a thread with an assigned resource pool
- Default configuration is not affected according to the CNA record
Fixed in
- Fixed in 4.5.0 (fix commit 85c1c4c21945d9b8fcef03216f1ccb2b27794e3d)
- Backports listed for v4.4 (PR 116390) and v4.3 (PR 116389); Zephyr 4.3.2 release notes list the CVE
- Unknown: whether a v4.4.x point release with the backport is tagged; v3.7 backport not confirmed
Workaround
- No vendor-documented workaround. Patching is the remedy.
- Builds without CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS are likely not exposed (not verified by the vendor).
Exploitation
- Exploited in the wild: no evidence found. Not verified against the CISA KEV catalogue.
- The advisory states the corruption was reproduced under QEMU x86_64; no separately published exploit was found.
- EPSS 0.0012 (Vulners).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Ask device vendors whether their firmware is based on Zephyr 3.5.0 to 4.4.2 and whether a fix is available.
- Apply the vendor firmware update or Zephyr 4.5.0 or a backported release.
- Prioritise internet-reachable devices and devices that run third-party application code.
- Verify the configuration options listed above on your own builds.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fg8c-9fhq-q7hv github.com
- Fix commit 85c1c4c21945d9b8fcef03216f1ccb2b27794e3d github.com
- Zephyr v4.4 backport PR 116390 github.com
- Zephyr 4.3.2 release notes github.com
- Zephyr security vulnerabilities docs.zephyrproject.org
- Vulners RAPID7:CVE-2026-19569 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:02.
Original description (NVD)
dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size, and for thread stack elements as STACK_ELEMENT_DATA_SIZE(size) (a round-up plus fixed overhead), without checking either expression for unsigned wrap-around. A size close to SIZE_MAX makes the computed total wrap to a very small value, so the heap chunk handed out is a few bytes while the object descriptor is still tagged with the full requested type and registered in the kernel object table. The size argument reaches that arithmetic directly from user mode. k_object_alloc_size() is declared __syscall in include/zephyr/sys/kobject.h, its verifier z_vrfy_k_object_alloc_size() in kernel/userspace/userspace_handler.c is a bare pass-through, and z_object_alloc() only range-checks otype — nothing bounds size. The stack-element branch is additionally reachable through the k_thread_stack_alloc() syscall via kernel/dynamic.c. Because subsequent kernel-object validation checks only the object's type and initialization state, the undersized handle passes K_SYSCALL_OBJ_INIT()/K_SYSCALL_OBJ_NEVER_INIT(), and the matching init syscall (for example k_mutex_init(), k_sem_init(), or k_thread_create()) then writes a complete object over the truncated allocation. An unprivileged user-mode thread can therefore trigger a supervisor-mode out-of-bounds write into the kernel resource-pool heap, of a size and content it substantially controls, corrupting sys_heap chunk metadata and adjacent kernel objects. Under CONFIG_GEN_PRIV_STACKS the thread-stack branch additionally stores an attacker-influenced wild pointer as a user thread's privileged stack base. The practical result is escape from the CONFIG_USERSPACE sandbox — kernel-level code execution or at minimum kernel memory corruption and system compromise. Exploitation requires CONFIG_USERSPACE together with CONFIG_DYNAMIC_OBJECTS (also selected by CONFIG_DYNAMIC_THREAD under userspace), and a calling thread with an assigned resource pool. The fix rejects both overflowing computations and frees the partially built descriptor.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.