Zephyr RTOS CVE-2026-11743

Exploitation requires two non-default conditions to be simultaneously present. First, the Zephyr firmware must have been explicitly compiled with CONFIG_USERSPACE enabled - this kernel feature is not active in default Zephyr builds and must be deliberately selected. Second, the SF32LB QSPI NOR flash device object must have been explicitly granted to an untrusted unprivileged thread using Zephyr's object access control APIs (k_object_access_grant or equivalent). These represent deliberate firmware design choices to provide isolated flash access, which the driver's deficient bounds check failed to enforce. Exploitation is further limited to hardware platforms incorporating the SF32LB SoC and its MPI QSPI NOR controller - no other Zephyr flash drivers are implicated. Read-path exploitation (memory disclosure) requires only the two conditions above; write-path exploitation additionally requires write permission on the device object for the thread. There is no network attack vector - access requires execution of code within the target device's thread context.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, score 6.6) accurately represents the attack surface: exploitation is local, low-complexity once prerequisites are satisfied, and gated behind low-privilege thread access to the flash device object. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from available data. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified. Real-world risk is strongly conditioned on two non-default configuration prerequisites: CONFIG_USERSPACE must be explicitly enabled in the firmware build, and an untrusted thread must have been deliberately granted the flash device object - neither condition is present in the default Zephyr configuration. For affected deployments (embedded systems intentionally using CONFIG_USERSPACE with flash access delegation), the read path represents the highest priority concern due to its C:H rating: arbitrary memory disclosure could expose cryptographic material, runtime secrets, or other sensitive data resident in CPU-addressable memory. The write path's I:L and A:L ratings are lower in severity but may carry disproportionate consequences in safety-critical or industrial-control deployments using SF32LB-based hardware, where cache corruption or out-of-range flash programming could affect firmware integrity. There is no network-accessible attack surface, which substantially limits the pool of exploitable deployments.

An attacker controlling an unprivileged Zephyr user-space thread that has been granted access to the SF32LB flash device calls flash_read() via the CONFIG_USERSPACE syscall interface, passing a crafted negative off_t offset alongside a valid destination buffer within its own memory domain. The signed-to-unsigned promotion causes the pre-fix bounds check to wrap and pass, and the subsequent memcpy copies data from arbitrary CPU-addressable memory below the flash base into the attacker's buffer, potentially disclosing cryptographic keys, runtime secrets, or other sensitive memory contents. No public exploit code was identified at time of analysis, but the vulnerability mechanics are well-understood and require only knowledge of the target device's memory layout to weaponize.