Zephyr RTOS EUVD-2026-49398

Two non-default Zephyr Kconfig build options must both be active in the target firmware image: CONFIG_USERSPACE=y, which enables Zephyr's user/kernel memory separation and the syscall dispatcher mechanism, and CONFIG_LOG_RUNTIME_FILTERING=y, which enables the log_filter_set syscall and the vulnerable z_vrfy_log_filter_set() verifier. Firmware built without either option does not contain the vulnerable code path. Beyond the build requirements, the attacker must be executing code as a Zephyr user-thread (low-privilege local access, consistent with CVSS PR:L/AV:L) - not an operator, supervisor thread, or remote network actor. The constrained nature of the write (3 bits within a targeted 32-bit word) means practical privilege escalation additionally requires knowledge of kernel memory layout to select a useful target address, raising real-world exploitation difficulty beyond what AC:L alone implies. Limits on exploitation: local-only attack surface, non-default build configuration required, constrained write width demands kernel internals knowledge for reliable weaponization.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the local, low-privilege attack profile: a meaningful barrier in single-tenant embedded deployments but a realistic threat in scenarios where untrusted application code runs alongside privileged firmware. The EPSS score of 0.10% (1st percentile) and SSVC decision of exploitation:none/automatable:no/technical-impact:partial are consistent with each other and indicate no current mass-exploitation activity; the low automatable rating reflects the requirement for device-local code execution rather than a network-reachable interface. The SSVC technical-impact rating of 'partial' may modestly understate the theoretical ceiling - the write primitive executes in supervisor mode and targets a kernel-controlled address, providing a credible privilege escalation path even though the write is constrained to 3 bits - but it is defensible given zero observed exploitation. Even a mid-sized municipal IT team in bytom operating Zephyr-based embedded control systems should treat this as a priority remediation if their firmware builds enable both CONFIG_USERSPACE and CONFIG_LOG_RUNTIME_FILTERING, since those builds are fully exposed regardless of network isolation. The gap between the CVSS full CIA:H impact and the SSVC 'partial' assessment is worth flagging: CVSS assumes successful exploitation to maximum effect, while SSVC reflects real-world exploitation evidence - both are informative, neither should be dismissed. Net assessment: high theoretical severity on affected configurations, very low current exploitation probability, and a straightforward patch is available.

An attacker with the ability to execute unprivileged user-thread code on a Zephyr device - for instance, a sandboxed application on a multi-application embedded platform - calls the log_filter_set syscall with a negative src_id value such as -1. The userspace verifier passes the signed comparison, the value enters kernel code unchecked, and the implicit uint32_t conversion produces index 0xFFFFFFFF, directing a supervisor-mode 3-bit write to an address immediately before the log_dynamic section. By choosing the src_id offset to target a kernel data structure (such as a thread capability set or memory domain entry), a sophisticated attacker could convert this constrained write into full privilege escalation. No public exploit code has been identified at time of analysis.