EUVD-2026-49398Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local unprivileged code execution is the sole runtime prerequisite once both Kconfig options are compiled in; full CIA impact reflects the supervisor-mode kernel memory corruption primitive.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative value for src_id (e.g. -1) trivially satisfied this check and was forwarded into z_impl_log_filter_set, where it propagated to filter_set() and ultimately to get_dynamic_filter(), which uses source_id as an unsigned index into the linker-section array &TYPE_SECTION_START(log_dynamic)[source_id].filters.
After implicit conversion through uint32_t, an int16_t -1 becomes 0xFFFFFFFF, indexing log_dynamic far out of bounds and causing the kernel to perform an OOB read and an OOB read-modify-write (LOG_FILTER_SLOT_GET/SET) against memory adjacent to the log_dynamic section.
The written value is a constrained 3-bit log level slot within the targeted 32-bit word, but the target address is attacker-chosen (a small negative offset from log_dynamic) and the write occurs in supervisor mode following a syscall from an unprivileged user thread, providing a kernel memory-corruption / privilege-escalation primitive.
The defect is reachable on any build with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y. Present from Zephyr v3.3.0 through v4.4.1. The fix replaces the signed bound check with an unsigned comparison: (uint32_t)src_id < log_src_cnt_get(domain_id), which correctly rejects negative inputs.
AnalysisAI
Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.
Technical ContextAI
Zephyr RTOS is an open-source real-time operating system maintained by the Zephyr Project (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*), primarily targeting embedded and IoT platforms. The defect is classified CWE-787 (Out-of-Bounds Write) and resides in z_vrfy_log_filter_set(), the userspace syscall verifier in subsys/logging/log_mgmt.c. The verifier is responsible for validating syscall arguments before forwarding them to the kernel-side implementation z_impl_log_filter_set(). The flaw is a classic signed-to-unsigned integer widening bug: the comparison src_id < (int16_t)log_src_cnt_get(domain_id) treats src_id as signed, so any negative value (e.g., -1) satisfies the check and is forwarded unchecked. Once inside the kernel, get_dynamic_filter() implicitly converts the int16_t to uint32_t - per C promotion rules, -1 becomes 0xFFFFFFFF - and uses that value as a direct index into the linker-section array TYPE_SECTION_START(log_dynamic)[source_id]. The resulting LOG_FILTER_SLOT_GET/SET operations perform a 3-bit read-modify-write to a supervisor-mode address controlled by the signed offset, corrupting kernel memory. The fix (commit 56a15114c6acbab2067fe406dc3adda8608f3def) corrects the comparison to (uint32_t)src_id < log_src_cnt_get(domain_id), which correctly rejects all negative inputs via unsigned arithmetic.
RemediationAI
Upgrade to Zephyr 4.5.0 or later, which incorporates the fix in commit 56a15114c6acbab2067fe406dc3adda8608f3def (https://github.com/zephyrproject-rtos/zephyr/commit/56a15114c6acbab2067fe406dc3adda8608f3def); the upstream patch is a single-line change replacing the signed comparison with an unsigned one in z_vrfy_log_filter_set(). The vendor security advisory is at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6vqh-mg7h-58qh. For deployments that cannot immediately rebuild and redeploy firmware, two Kconfig-level workarounds exist: disabling CONFIG_LOG_RUNTIME_FILTERING eliminates the vulnerable syscall path entirely at the cost of losing runtime log-level filtering capability, which may affect diagnostic workflows but carries no security downside; alternatively, disabling CONFIG_USERSPACE removes the entire user/kernel separation model, which eliminates the attack surface but also removes Zephyr's memory protection architecture - a significant security regression that should only be used as a last resort on hardware with no untrusted code paths. Both workarounds require a firmware rebuild and physical or OTA redeployment.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today