Zephyr RTOS CVE-2026-12232

Exploitation requires two simultaneous, deliberate configuration preconditions: the Zephyr kernel must be built with CONFIG_USERSPACE=y, which activates the syscall dispatch mechanism and userspace isolation framework; and the attacking thread must have been explicitly granted access to the Intel ALH DAI device object via k_object_access_grant() or an equivalent API call by a privileged thread or initialization code. Neither condition is the result of passive misconfiguration - both require affirmative operator or developer choices. The attack is additionally constrained to systems running on Intel SoC hardware that physically includes the ALH Audio Link Hub peripheral. What limits exploitation: CONFIG_USERSPACE is a build-time opt-in and is not universally enabled across Zephyr deployments; device-object access grants are explicit per-thread permissions requiring code-level setup; exploitation is strictly local with no network attack path; and the DoS variant requires a stream_id that resolves to an unmapped page, which is an incidental side effect rather than a reliable denial-of-service primitive.

The CVSS 3.1 base score of 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) accurately reflects the threat profile: local access is required, complexity is low once prerequisites are met, and the attacker needs at least low privilege in the form of an explicit device-object permission grant. The High confidentiality rating is defensible - iterating the syscall across a broad signed stream_id range enables reconstruction of kernel memory bytes and, via the leaked FIFO address, partial disclosure of kernel address-space layout, which is meaningful for KASLR bypass chains. The Low availability impact captures the realistic DoS surface: a stream_id resolving to an unmapped page faults in kernel context and may crash the system, but this is not a persistent or remotely triggerable denial of service. No EPSS score was included in the source data, so probabilistic exploitation likelihood cannot be quantified from available signals. The CVE does not appear in the CISA KEV catalog, and no public proof-of-concept code has been identified, placing this firmly in the 'no confirmed active exploitation' tier. The exploitation prerequisites - CONFIG_USERSPACE=y at build time and an explicit device-object access grant to the attacking thread - are deliberate operator choices that meaningfully reduce the population of exposed systems compared to a raw CVSS score might suggest; even a mid-sized municipal IT team in kalisz running Zephyr-based industrial IoT gateways with broad device grants should prioritize this patch during their next maintenance window, since those deployment patterns are realistic in RTOS environments. Overall, this is a genuine medium-priority issue, not inflated by theoretical CVSS scoring and not dismissible as unexploitable.

A user-mode thread on an Intel ALH-equipped Zephyr device that has been granted access to the ALH DAI device object calls dai_get_properties_copy() in a loop, supplying stream_id values incrementally outside the valid 0-63 range - both negative values and values above 63. Each call causes the kernel to read one byte from an attacker-controlled signed offset relative to alh_handshake_map[] and copy it back to userspace in the dma_hs_id field, while also returning a FIFO register address computed from the out-of-range index, leaking kernel addressing information. No public exploit code has been identified at time of analysis.