Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-19669— Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zephyr 内核中 文件下的用户态系统调用验证函数 和 声明了两个变长数组（VLA）： 和 。这两个数组的大小直接由调用者提供的 参数决定。 是一个未经验证的 类型值，直接来自系统调用 ABI。这些变长数组是在任何检查之前分配的，甚至早于 对象权限检查。随后的 调用仅验证用户源缓冲区是否可读，而内核目的缓冲区从未进行过边界检查，因为其大小与攻击者控制的 相同。 任何在用户模式下运行且启用了 的线程都可以使用较大的 值调用 或 。这首先以任意攻击者选择的数量偏移了监督栈指针——由于 Zephyr 未启用栈冲突检测（

CVSS 7.8 · High EPSS 0.12% · P2

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 3.4.0< 4.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19669

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode
Source: CVE Program / CVE List V5
Vulnerability Description
The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-length arrays, union fuel_gauge_prop_val k_vals[len] and fuel_gauge_prop_t k_props[len], sized directly by the caller-supplied len argument. len is an unvalidated size_t taken straight from the syscall ABI, and the VLAs were allocated before any check at all — including before the K_SYSCALL_DRIVER_FUEL_GAUGE() object-permission check. The subsequent k_usermode_from_copy() calls validated only that the user source buffer was readable; the kernel destination was never bounds-checked, since it was sized by the same attacker-chosen len. Any thread running in user mode with CONFIG_USERSPACE enabled can invoke fuel_gauge_get_props() or fuel_gauge_set_props() with a large len. This first displaces the supervisor stack pointer by an arbitrary attacker-chosen amount — Zephyr does not build with stack-clash probing, so the displacement itself does not fault, and the nested calls made by the verifier then write frames below the privileged stack. If the caller has been granted access to a fuel-gauge device object, the memcpy inside k_usermode_from_copy() additionally writes len * sizeof(union fuel_gauge_prop_val) bytes of fully attacker-controlled data starting well below the stack base. CONFIG_PRIVILEGED_STACK_SIZE defaults to 1024 bytes, so a len of roughly 170 already exhausts it. The result is an out-of-bounds write in supervisor mode with attacker-controlled length and, on the permitted path, attacker-controlled content — a break out of the user-mode sandbox into kernel memory, leading to kernel code execution or a system crash. A stack guard region does not contain it, because the copy begins below the guard and walks upward, corrupting unprotected memory before the guard is reached. The fix removes the kernel-side copies entirely and validates the caller's arrays in place with K_SYSCALL_MEMORY_ARRAY_READ() / K_SYSCALL_MEMORY_ARRAY_WRITE(), which also handle the len * size multiplication overflow; this is safe because neither fuel_gauge_prop_t nor union fuel_gauge_prop_val contains embedded pointers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.4.0 ~ 4.5.0 -

II. Public POCs for CVE-2026-19669

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19669

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-19669 (1)

Vendor Advisories for CVE-2026-19669 (1)

Same Patch Batch · zephyrproject · 2026-10-11 · 11 CVEs total

CVE-2026-19736 7.8 HIGH Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request leng
CVE-2026-19935 7.5 HIGH Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item i
CVE-2026-19577 7.1 HIGH Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer ad
CVE-2026-19576 6.8 MEDIUM Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated
CVE-2026-19740 6.5 MEDIUM Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update p
CVE-2026-19738 6.5 MEDIUM Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedure
CVE-2026-19739 6.5 MEDIUM Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives
CVE-2026-19737 5.5 MEDIUM NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
CVE-2026-19735 4.8 MEDIUM Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails sil
CVE-2026-18418 3.4 LOW Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's chan

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-787

V. Comments for CVE-2026-19669

No comments yet

Leave a comment