CVE-2026-10669: Xtensa MPU Privilege Escalation Vulnerability

CVE-2026-10669 Overview

CVE-2026-10669 is an integer overflow vulnerability in the Zephyr RTOS Xtensa Memory Protection Unit (MPU) implementation. The flaw resides in arch_buffer_validate() within arch/xtensa/core/mpu.c, which validates user-mode buffer accessibility. The function defaults its return value to 0 (access permitted) and only sets a denial result inside its per-MPU-region probe loop. When ROUND_UP(size + offset) overflows to 0, the loop executes zero iterations and validation succeeds without probing any MPU region. Affected versions span v3.7.0 through v4.4.0 on Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE.

Critical Impact
An unprivileged user-mode thread can bypass buffer validation, enabling the kernel to read from or write to attacker-chosen kernel or other-partition memory, resulting in information disclosure, memory corruption, and privilege escalation.

Affected Products

Zephyr RTOS v3.7.0 through v4.4.0
Xtensa SoCs configured with CONFIG_XTENSA_MPU and CONFIG_USERSPACE
Any Zephyr-based firmware exposing syscalls that use k_usermode_from_copy, k_usermode_to_copy, or k_usermode_string_copy

Discovery Timeline

2026-07-14 - CVE-2026-10669 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10669

Vulnerability Analysis

The vulnerability is an integer overflow classified as [CWE-787] Out-of-bounds Write. The arch_buffer_validate() function is the architecture hook that verifies whether a user-mode-supplied buffer is accessible to the calling user thread with the requested permission. The function initializes its return value to 0, meaning access permitted, and only assigns a denial result inside its per-MPU-region probe loop.

When an attacker crafts an (addr, size) pair such that size + alignment offset approaches SIZE_MAX, the ROUND_UP macro can wrap the 32-bit address space to 0. The probe loop then executes zero iterations. The function returns 0 without checking a single MPU region, indicating the buffer is accessible.

Syscall-layer pre-checks such as K_SYSCALL_MEMORY_SIZE_CHECK and Z_DETECT_POINTER_OVERFLOW catch only raw addr+size wraps. They do not cover the ROUND_UP-induced wrap. The string path via arch_user_string_nlen -> arch_buffer_validate has no syscall-layer guard at all.

Root Cause

The root cause is fail-open defaulting combined with unchecked arithmetic. arch_buffer_validate() treats the absence of a denial finding as success, and no explicit check exists for size_add overflow on the rounded extent. Any buffer whose rounded range wraps bypasses validation entirely.

Attack Vector

An unprivileged user-mode thread invokes any syscall that validates buffers through k_usermode_from_copy, k_usermode_to_copy, or k_usermode_string_copy. The thread supplies a crafted (addr, size) that causes rounded-extent overflow. Validation returns success. The kernel then reads from attacker-chosen memory (disclosure) or, when write=1, writes attacker-controlled data to kernel or other-partition memory (corruption).

// Security patch in arch/xtensa/core/mpu.c
#include <zephyr/arch/xtensa/mpu.h>
#include <zephyr/linker/linker-defs.h>
#include <zephyr/sys/__assert.h>
+#include <zephyr/sys/math_extras.h>
#include <zephyr/sys/util_macro.h>

#include <xtensa/corebits.h>

Source: Zephyr commit 3b1bdaf. The fix imports math_extras.h to enable size_add_overflow checks, defaults the return value to -EINVAL, and sets success only after the full range is validated.

Detection Methods for CVE-2026-10669

Indicators of Compromise

User-mode threads invoking syscalls with buffer sizes near SIZE_MAX or 0xFFFFFFFF
Kernel panics, faults, or resets originating from arch_buffer_validate() call paths
Unexpected kernel memory writes following calls to k_usermode_from_copy or k_usermode_string_copy
Anomalous string operations passing lengths that cause ROUND_UP overflow

Detection Strategies

Static analysis of Zephyr firmware images to identify affected versions (v3.7.0 through v4.4.0) with CONFIG_XTENSA_MPU and CONFIG_USERSPACE enabled
Runtime instrumentation of syscall entry points to log buffer size and address arguments exceeding safe bounds
Fuzzing user-mode syscall interfaces with boundary values near SIZE_MAX to trigger fault behavior on unpatched builds

Monitoring Recommendations

Collect and centralize kernel fault logs from Xtensa-based devices for anomaly review
Track firmware build manifests to confirm Zephyr version and MPU configuration across deployed fleets
Alert on repeated syscall failures or unexpected reboots that correlate with user-mode application activity

How to Mitigate CVE-2026-10669

Immediate Actions Required

Upgrade Zephyr RTOS to a version containing commit 3b1bdaf5482188ca110ef9a411aaa8c7d3db3b16 or later
Inventory all Xtensa-based devices built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE and prioritize firmware updates
Audit custom syscalls that call arch_buffer_validate() directly or via string helpers for additional size checks

Patch Information

The upstream fix is available in the Zephyr repository. Review the GitHub Security Advisory GHSA-4r4p-gh69-v6w4 and the remediation commit. The patch changes the default return value to -EINVAL (deny by default), adds an explicit size_add_overflow check, and sets the success value only after the full range has been validated.

Workarounds

Disable CONFIG_USERSPACE where user-mode isolation is not strictly required, eliminating the attack surface
Add application-layer size caps on parameters passed to syscalls that copy from or to user memory
Restrict which user-mode threads can invoke sensitive syscalls until firmware is patched

bash

# Verify Zephyr version and rebuild against a patched tree
west list zephyr
west update
west build -p always -b <your_xtensa_board> <app>