Zephyr RTOS CVE-2026-10677

Exploitation requires that the Zephyr system be compiled with CONFIG_USERSPACE enabled - without this build-time flag, z_vrfy_k_poll() is not present in the kernel binary and the vulnerability does not exist. The attacker must be executing as a low-privilege user thread (PR:L per CVSS) on the target device; remote network access alone is insufficient (AV:L). The attack additionally relies on the ability to spawn new threads within the process, since heap exhaustion is amplified by spawning threads that inherit the parent's resource_pool. Exploitation is limited to versions v1.12.0 through v4.4.1; v4.5.0 and later are not affected. No configuration of specific kernel objects beyond the default k_poll interface is required - any low-privilege user thread that can invoke k_poll() can trigger the leak. User interaction from other users or operators is not required (UI:N).

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H yields a 6.5 medium score that is directionally accurate but may understate practical severity in embedded contexts. The scope change (S:C) correctly captures that heap exhaustion radiates beyond the attacking thread to the entire shared kernel resource pool - impacting all threads and kernel subsystems drawing from it. The AC:L rating is defensible: once CONFIG_USERSPACE is enabled and a user thread is present, no special timing, race conditions, or environmental factors are needed. EPSS data was not present in the provided intelligence, so exploitation probability cannot be quantified from that signal. Neither a CISA KEV listing nor public POC code has been identified, meaning active exploitation is not confirmed. However, the attack mechanism is mechanically straightforward - any user thread can execute it without sophisticated tooling - and the amplification via inherited resource pools makes reliable heap exhaustion achievable. For safety-critical embedded and IoT deployments where Zephyr is commonly used, loss of kernel allocation capability can cascade into hard faults or watchdog resets, elevating the operational impact well above what a CVSS base score communicates in isolation. No conflicting signals between the CVSS vector and the description were identified; AV:L is appropriate since exploitation requires thread execution on the device itself.

A low-privilege user thread running on a Zephyr device with CONFIG_USERSPACE enabled calls k_poll() in a tight loop, passing a k_poll_event[] array containing a forged or invalid kernel object handle. Each iteration causes z_vrfy_k_poll() to allocate events_copy via z_thread_malloc(), immediately kill the thread via K_OOPS without freeing the buffer, then resume - permanently leaking the allocation. The attacker spawns additional threads that inherit the parent's resource_pool, multiplying the leak rate across threads until the shared kernel heap is exhausted and legitimate kernel allocations for queues, message buffers, and future k_poll calls begin to fail system-wide, triggering denial of service.