What is the CVSS score of EUVD-2026-46446?

EUVD-2026-46446 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-46446?

Yes, a patch is available for EUVD-2026-46446. Update the affected software to the latest version immediately.

Zephyr RTOS EUVD-2026-46446

| CVE-2026-10677 MEDIUM

Memory Leak (CWE-401)

2026-07-21 zephyr

Denial Of Service Zephyr Zephyrproject

6.5

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

AV:L because exploitation requires local thread execution on the device; PR:L for any valid user-mode thread; S:C because heap exhaustion impacts the entire shared kernel resource pool beyond the attacker's own thread.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 01:49 vuln.today

Analysis Generated

Jul 22, 2026 - 01:49 vuln.today

DescriptionCVE.org

The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy.

A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service.

The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.

AnalysisAI

Kernel heap exhaustion in Zephyr RTOS affects all builds with CONFIG_USERSPACE enabled from v1.12.0 through v4.4.1, allowing any low-privilege user thread to permanently leak kernel memory by supplying a forged object handle to k_poll(). The z_vrfy_k_poll() syscall verifier allocates a kernel-side event copy but, prior to the fix, killed the calling thread via K_OOPS without freeing that buffer - a path any user thread can trigger repeatedly. By spawning additional threads that inherit the parent's resource_pool, an attacker can multiply the leak rate until the shared kernel heap is depleted, causing system-wide denial of service affecting queues, message buffers, and all future k_poll calls. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerable function is z_vrfy_k_poll() in kernel/poll.c, the userspace syscall verifier activated only when Zephyr is built with CONFIG_USERSPACE. When a user thread calls k_poll(), the verifier allocates a kernel-side copy of the caller's k_poll_event[] array via z_thread_malloc() and then validates each event's object handle using K_SYSCALL_OBJ(). Pre-fix code wrapped these checks in K_OOPS() macros, which abort the calling thread immediately on a validation failure - before the loop can reach the cleanup path that would free events_copy. This is a textbook CWE-401 (Missing Release of Memory after Effective Lifetime): the buffer is acquired, an abnormal exit path bypasses the corresponding free, and the allocation is permanently orphaned. Because Zephyr threads inherit their parent's resource_pool (kernel/thread.c), each sacrificial thread spawned by an attacker draws from the same heap region, enabling leak amplification without requiring privileged operations. The CPE cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:* covering v1.12.0 onward reflects that the k_poll userspace exposure has carried this defect since it was first introduced. The commit diff confirms five distinct K_OOPS call sites were replaced with conditional goto oops_free blocks, ensuring the buffer is freed before thread termination in all error cases.

RemediationAI

The primary fix is to upgrade to Zephyr v4.5.0 or later, which incorporates the patch committed at https://github.com/zephyrproject-rtos/zephyr/commit/8dc7a37bc75402a0a3329397887f32f5fb4da3ad. Note that this is a GitHub commit reference rather than a tagged release artifact - the exact release version is confirmed as v4.5.0 by EUVD-2026-46446 (affected versions listed as less than 4.5.0). For deployments that cannot upgrade immediately, the most effective compensating control is to disable CONFIG_USERSPACE in the kernel build configuration if userspace thread isolation is not required; this removes z_vrfy_k_poll() entirely, eliminating the vulnerable code path at the cost of losing userspace privilege separation. If CONFIG_USERSPACE must remain enabled, restrict application design so that untrusted threads cannot call k_poll() or spawn arbitrary child threads - reducing the number of threads that can reach the vulnerable path limits leak rate and extends time-to-impact. Monitoring Zephyr's kernel memory pool statistics for anomalous heap depletion can serve as a detection signal. Full advisory details are at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r3cc-8wcr-xfj9.