Zephyr RTOS CVE-2026-19571

Requires a device running Zephyr with the ITE IT8xxx2 SHI host-command backend (ec_host_cmd_backend_shi_ite.c) active as the EC host-command transport. The attacker must control the SPI host controller - i.e., a compromised host OS driving chip-select and clock, or physical access to the SPI lines - and must win a timing race: after a valid first request, de-assert chip select (returning the driver to ready and re-enabling the FIFO) and start a second transaction carrying a header with data_len=0xFFFF, landing those 8 bytes in in_msg during the window before the host-command thread executes args.input_buf_size = rx_header->data_len. Meaningful disclosure further depends on the registered command handler copying or echoing input_buf_size bytes. Limiting factors: local bus access only (no network vector), high attack complexity due to the race, and the fact that the pre-patch bug needs interrupts accepted in states other than SHI_STATE_DISABLED; note the fix leaves a residual bounded race (an end-of-transaction interrupt still resets to ready while the buffer is owned), unlike the NPCX backend which parks in SHI_STATE_CNL_RESP_NOT_RDY.

This is a genuine but access-gated vulnerability rather than a high-urgency internet-facing one. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H, 6.7 Medium) is internally consistent with the description: the attack is LOCAL because it requires driving the inter-processor SHI/SPI bus, and AC:H correctly reflects that exploitation hinges on winning a timing race against the host-command thread. PR:N is technically accurate - there is no authentication on the SHI bus itself - but this should not be read as 'remote unauthenticated' in the network sense; the attacker must already be the SPI controller (a compromised host OS or physical SPI-line access), which is a substantial precondition. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is 'no public exploit identified at time of analysis.' The race is retryable indefinitely by the SPI controller, which somewhat offsets the AC:H difficulty for a determined local attacker. Impact is real: C:H reflects disclosure of up to ~64 KiB of adjacent embedded-controller memory, and A:H reflects a controller fault when the read runs past SRAM. No key signals are in direct conflict; the main caveat is that the high C/A impact is only reachable by an attacker already positioned on the inter-processor bus, so prioritization should weigh the deployment's threat model (is the host OS trusted?) heavily.

An attacker who has compromised the host operating system (or has physical access to the SPI lines) acts as the SHI/SPI controller, sends a well-formed host-command request, then immediately de-asserts chip select and begins a second transaction whose 8-byte header declares data_len = 0xFFFF. If the second header lands in the window before the embedded-controller host-command thread reads rx_header->data_len, the framework hands a registered command handler a 65535-byte input length over a 256-byte buffer, producing an out-of-bounds read that leaks adjacent EC memory back to the host or faults the controller. No public exploit code is identified, but the SPI controller can retry the race indefinitely until it wins.