EUVD-2026-57070Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
AV:L and PR:L per storage write requirement; AC:H for non-trivial primitive conversion; S:C because supervisor sandbox boundary is explicitly crossed from user-mode extension context.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
Lifecycle Timeline
2DescriptionCVE.org
The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and then performed the relocation write there without validating rela.r_offset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llext_file_offset().
rela.r_offset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via r_offset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs.
The path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial.
The fix adds a bound check rejecting any RELA entry whose r_offset >= tgt->sh_size, mirroring the existing validation in the shared branch.
AnalysisAI
Out-of-bounds write in Zephyr RTOS's llext subsystem allows a local attacker with low privileges to corrupt supervisor-context memory by loading a crafted relocatable ELF extension on Xtensa targets. The vulnerability in llext_link_plt() (subsys/llext/llext_link.c) occurs before any extension code executes - at link time - meaning sandbox protections are bypassed entirely. Exploitation complexity is high (CVSS AC:H) due to constraints on the write value, no public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to deployments using llext on Xtensa architecture.
Technical ContextAI
The Linkable Loadable Extensions (llext) subsystem in Zephyr RTOS enables dynamic loading of compiled ELF modules at runtime. Zephyr explicitly documents llext as capable of accepting extensions of untrusted origin. The vulnerable function, llext_link_plt() in subsys/llext/llext_link.c, processes PLT/RELA relocation entries during the Xtensa-specific relocatable (partially-linked) ELF path (the tgt != NULL branch). The patch address is calculated as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset, and the relocation write is performed at that address without first validating that rela.r_offset falls within the target section's bounds. The sibling shared/dynamic branch already performed equivalent validation via llext_file_offset(), creating an asymmetric validation gap. CWE-787 (Out-of-bounds Write) is the root cause: rela.r_offset is attacker-controlled input read directly from the ELF RELA table, allowing a crafted entry to cause the write to land arbitrarily beyond the extension's text buffer in supervisor memory. All Zephyr versions are affected per CPE cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:* prior to the upstream commit fix. The fix mirrors the existing validation: a guard rejecting any RELA entry where rela.r_offset >= tgt->sh_size was added to the Xtensa relocatable branch.
RemediationAI
The primary remediation is to integrate upstream commit 106540afbd22087ad40b90f53fb22657754a719e from the Zephyr repository, which adds the bounds check (if rela.r_offset >= tgt->sh_size, skip the entry) to llext_link_plt(). Refer to the vendor advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xv9q-6mrf-8j49 and confirm the fix is included in the Zephyr SDK version used by the project. A specific patched release version was not confirmed in the available data - verify with upstream release notes before closing the finding. Where immediate patching is not feasible, the most effective compensating control is disabling llext entirely via CONFIG_LLEXT=n in the Kconfig build configuration, which eliminates the attack surface at the cost of losing dynamic extension loading capability. Alternatively, restrict extension loading to cryptographically signed, trusted-source ELFs and enforce that restriction in the application layer - this reduces attacker ability to supply crafted input, though it does not fix the underlying code defect. Restricting write access to extension storage paths to privileged processes only (AV:L, PR:L mitigation) reduces the attacker population but does not eliminate the vulnerability for privileged users.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today