CVE-2026-10682: Zephyr RTOS Privilege Escalation Flaw

CVE-2026-10682 Overview

CVE-2026-10682 is an out-of-bounds write vulnerability in the Zephyr real-time operating system (RTOS) logging subsystem. The userspace verifier z_vrfy_log_filter_set() in subsys/logging/log_mgmt.c performs a signed comparison against the attacker-controlled int16_t src_id parameter. A negative value trivially passes the check and propagates as an unsigned index into the log_dynamic linker section array. The defect is reachable on any build configured with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y, affecting Zephyr v3.3.0 through v4.4.1. The classification maps to [CWE-787] Out-of-Bounds Write.

Critical Impact
An unprivileged user thread can trigger a supervisor-mode out-of-bounds read-modify-write to an attacker-chosen address near the log_dynamic section, producing a kernel memory-corruption and privilege-escalation primitive.

Affected Products

Zephyr RTOS v3.3.0 through v4.4.1
Builds with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y
Embedded and IoT devices leveraging Zephyr runtime log filtering from user mode

Discovery Timeline

2026-07-27 - CVE-2026-10682 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-10682

Vulnerability Analysis

The vulnerability resides in the userspace syscall verifier for log_filter_set. The verifier validates the source identifier using a signed comparison: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative int16_t value, such as -1, satisfies this bound check and is forwarded to z_impl_log_filter_set. The value then propagates through filter_set() into get_dynamic_filter(), which indexes the linker-section array &TYPE_SECTION_START(log_dynamic)[source_id].filters using source_id as an unsigned quantity.

After implicit conversion through uint32_t, an int16_t value of -1 becomes 0xFFFFFFFF. The kernel then performs an out-of-bounds read and an out-of-bounds read-modify-write via the LOG_FILTER_SLOT_GET and LOG_FILTER_SLOT_SET macros. The write targets memory adjacent to the log_dynamic section while executing in supervisor mode.

Root Cause

The root cause is a signed-versus-unsigned integer mismatch in the syscall verifier. The verifier compares a signed int16_t against an unsigned count, allowing negative values to bypass validation. Downstream code then treats the same value as an unsigned array index, converting the sign bit into a very large positive offset.

Attack Vector

Exploitation requires local access and low privileges: an unprivileged user thread invokes the log_filter_set syscall with a negative src_id. The written value is a constrained 3-bit log level slot within the targeted 32-bit word. The target address, however, is attacker-chosen through the negative offset, allowing selective corruption of kernel memory adjacent to the logging section.

// Source: https://github.com/zephyrproject-rtos/zephyr/commit/56a15114c6acbab2067fe406dc3adda8608f3def
// Security patch in subsys/logging/log_mgmt.c
		"Setting per-backend filters from user mode is not supported"));
	K_OOPS(K_SYSCALL_VERIFY_MSG(domain_id == Z_LOG_LOCAL_DOMAIN_ID,
		"Invalid log domain_id"));
-	K_OOPS(K_SYSCALL_VERIFY_MSG(src_id < (int16_t)log_src_cnt_get(domain_id),
+	K_OOPS(K_SYSCALL_VERIFY_MSG((uint32_t)src_id < log_src_cnt_get(domain_id),
		"Invalid log source id"));
	K_OOPS(K_SYSCALL_VERIFY_MSG(
		(level <= LOG_LEVEL_DBG),

The patch replaces the signed bound check with an unsigned comparison, ensuring that negative inputs are rejected before reaching the array indexing operation. See the Zephyr commit 56a15114 for the complete change.

Detection Methods for CVE-2026-10682

Indicators of Compromise

Unexpected kernel oops or fault records referencing z_impl_log_filter_set or get_dynamic_filter call frames.
User threads invoking log_filter_set with unusual or negative src_id values captured in syscall traces.
Memory corruption symptoms adjacent to the log_dynamic linker section, such as altered adjacent global variables or function pointers.

Detection Strategies

Audit Zephyr build configurations for the combination of CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y and flag any deployed firmware image that predates the fix.
Instrument the log_filter_set syscall path with additional bounds logging during test and QA cycles to catch anomalous parameter ranges.
Cross-reference firmware version manifests against Zephyr v3.3.0 through v4.4.1 to identify vulnerable devices in the fleet.

Monitoring Recommendations

Track kernel exception counters and log filter modification events on embedded devices that expose user-mode logging APIs.
Alert on repeated K_OOPS events originating from the logging syscall verifier, which may indicate exploitation attempts.
Include Zephyr version telemetry in device inventory feeds to detect regressions or downgraded firmware on production units.

How to Mitigate CVE-2026-10682

Immediate Actions Required

Update Zephyr to a release containing commit 56a15114c6acbab2067fe406dc3adda8608f3def, which corrects the signed bound check.
Rebuild and redeploy affected firmware images for all embedded devices running Zephyr v3.3.0 through v4.4.1.
Restrict which user-mode threads and applications can invoke log_filter_set on devices that cannot be immediately patched.

Patch Information

The fix is available in the upstream Zephyr project via commit 56a15114. Full details are documented in GitHub Security Advisory GHSA-6vqh-mg7h-58qh. The patch changes the verifier check to (uint32_t)src_id < log_src_cnt_get(domain_id), correctly rejecting negative inputs.

Workarounds

Disable CONFIG_LOG_RUNTIME_FILTERING in device Kconfig when runtime log filter changes from user mode are not required.
Disable CONFIG_USERSPACE on builds that do not need user-mode isolation, eliminating the syscall entry point.
Apply the one-line verifier change out-of-tree as a local patch until an official Zephyr release is adopted.

bash

# Kconfig example to disable runtime log filtering as a temporary workaround
CONFIG_LOG=y
CONFIG_LOG_RUNTIME_FILTERING=n