Zephyr SMP Race Condition in thread_idx_alloc Breaking ACL Isolation

Vulnerability Overview A race condition exists in the function in Zephyr, causing threads concurrently calling to share a kernel object permissions slot. Specifically: In Zephyr’s userspace dynamic object subsystem, the function does not hold the when allocating new thread permission indexes. On SMP systems, when two user-space threads concurrently call , they may observe the same free bits, perform non-atomic RMW (Read-Modify-Write) operations, and return the same . The two newly created objects are assigned the same , causing user-space threads to share a bit position in the core object permission bitmaps. Any subsequent access permissions granted to a kernel object for one thread are effectively granted to the other thread, breaking ACL isolation. Between and , there is an unlocked window for updating , which may lead to leaks of entries from the thread index pool. Impact Scope Affected Versions: All releases through v4.0.0 (configured with ). Fixed Versions: 4.5.0 (fix merged into the branch but not yet released). Remediation Fix Method: The issue was resolved by holding the and inlining within the traversal. Fix Commit: (Kernel threads: Allocate index number for dynamic thread creation, 2018-08-08; the race condition has existed since then). Branch Status: - branch: PR #109616, merged. - : PR #111409, merged. - : PR #111410, merged. - : PR #111408, merged. Evidence — After the fix, no longer holds and is inlined during traversal. — already holds for matching updates (set by ). — calls for and stores the returned into . — reads a data-less ; a collision implies ACL bits for two threads. — does not apply permission checks, so any user-space thread can reach . — is declared as . — The default value of is 2 (16 indexes); the bitmap is small, making collisions on the same byte common. — lines 271-300 confirm the pre-fix function did not hold the lock. — lines 270-318 confirm the same code was released in v4.4.0. Patch Branches: , , , Pull Requests: #109616, #111409, #111410, #111408 Status: Merged Additional Information For questions or comments, open an issue on . Or send an email to . Embargo Date: 2026-07-25 Key Information CVE ID: CVE-2026-10881 CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: Low Weakness: CVE-982 Summary This vulnerability involves an SMP race condition in the Zephyr kernel that may cause concurrent threads to share kernel object permission slots, thereby breaking ACL isolation. The fix has been merged into multiple branches and is expected to be released in version 4.5.0.

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr SMP Race Condition in thread_idx_alloc Breaking ACL Isolation

More from this source