CVE-2026-11743 Overview
CVE-2026-11743 is an out-of-bounds read and write vulnerability in the Zephyr RTOS SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c). The driver validates flash offsets using the check (offset + size) > data->size, where offset is a signed off_t and size is unsigned. A negative offset converts to a large unsigned value that wraps during addition, bypassing the bounds check. An unprivileged userspace thread granted access to the flash device can pass a crafted negative offset through the flash_read or flash_write syscalls to read arbitrary CPU-addressable memory or corrupt out-of-range flash regions.
Critical Impact
A local, low-privileged attacker can disclose kernel or peripheral memory and program flash outside the mapped window, breaking confidentiality, integrity, and availability boundaries enforced by CONFIG_USERSPACE.
Affected Products
- Zephyr RTOS builds using the SF32LB MPI QSPI NOR flash driver
- Configurations with CONFIG_USERSPACE enabled that grant the raw flash device object to untrusted threads
- Devices based on the SiFli SF32LB family relying on the vulnerable driver path
Discovery Timeline
- 2026-08-07 - CVE-2026-11743 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-11743
Vulnerability Analysis
The flaw is a classic signed-to-unsigned conversion issue combined with integer overflow in bounds validation [CWE-125]. The driver stores the mapped flash window size in an unsigned field and compares it against offset + size. Because offset is signed, a negative value promotes to a large unsigned quantity. The addition then wraps modulo 2^32, producing a small result that satisfies the comparison. The erase path already rejected negative offsets, but the read and write paths did not apply the same guard.
On the read path, the driver executes memcpy(dst, (void *)(data->base + offset), size). A negative offset slides the source pointer below data->base into adjacent CPU-addressable memory, including SRAM or memory-mapped peripherals. The write path programs flash at the out-of-range address and calls cache invalidation against data->base + offset, corrupting attacker-selected cache ranges.
Root Cause
The root cause is mixed signed and unsigned arithmetic in a boundary check that lacks overflow-safe evaluation. The flash_read and flash_write syscall verifiers under CONFIG_USERSPACE validate the device handle and the caller's buffer but delegate offset checking to the driver, which fails to reject negative values.
Attack Vector
An unprivileged thread that holds a permission grant on the flash device object invokes flash_read or flash_write with a crafted negative offset and a buffer resident in its own memory domain. The syscall path reaches the unchecked pointer arithmetic and copies data across the userspace boundary, or programs flash outside the intended region.
// Patch excerpt from drivers/flash/flash_sf32lb_mpi_qspi_nor.c
uintptr_t base;
uint32_t size;
struct sf32lb_dma_dt_spec dma;
+ uint8_t write_buf[SPI_NOR_PAGE_SIZE] __aligned(4);
uint8_t lines;
uint8_t psclr;
bool invert_rx_clk;
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/909eb568750304d68ea481d1b56a489ae670bdae
The fix replaces the vulnerable check with qspi_nor_range_is_valid(), which rejects negative offsets and performs bounds comparison in overflow-safe 64-bit arithmetic on both read and write paths. It also introduces an SRAM DMA bounce buffer and source/destination overlap rejection to eliminate a separate DMA bus-hang condition.
Detection Methods for CVE-2026-11743
Indicators of Compromise
- Userspace threads issuing flash_read or flash_write syscalls with offsets outside the documented flash window
- Unexpected reads of SRAM or peripheral memory contents appearing in userspace buffers granted flash access
- Flash content corruption or cache invalidation events targeting addresses outside data->base to data->base + data->size
Detection Strategies
- Audit Zephyr build configurations for CONFIG_USERSPACE combined with permission grants on SF32LB QSPI NOR flash device objects
- Instrument the flash driver in test builds to log calls with signed-negative offsets and flag them as anomalous
- Review firmware images against the fixed Zephyr commit 909eb568 to confirm inclusion of qspi_nor_range_is_valid()
Monitoring Recommendations
- Track userspace thread syscall telemetry for anomalous flash operations, particularly repeated invocations with unusual offset patterns
- Monitor device attestation and secure boot logs for unexpected flash modifications outside application-defined regions
- Establish baselines for legitimate flash driver access so out-of-window arithmetic patterns stand out
How to Mitigate CVE-2026-11743
Immediate Actions Required
- Rebuild affected Zephyr firmware from a tree that includes commit 909eb568750304d68ea481d1b56a489ae670bdae and deploy to affected devices
- Audit application code for grants of the raw SF32LB QSPI NOR flash device to userspace threads and revoke where not strictly required
- Treat any firmware image built before the fix as vulnerable when CONFIG_USERSPACE is enabled
Patch Information
The fix is available in the Zephyr project via the GitHub commit for the SF32LB flash driver and documented in the Zephyr GHSA-c6wh-gwg4-fj5j security advisory. The patch replaces the arithmetic bounds check with qspi_nor_range_is_valid() and adds a page-sized DMA bounce buffer with overlap rejection.
Workarounds
- Disable CONFIG_USERSPACE in builds that do not require memory-domain isolation, eliminating the syscall reachability path
- Remove grants of the raw flash device object from untrusted threads and expose only a higher-level, offset-validating service instead
- Restrict flash operations to trusted supervisor threads until the patched driver is deployed
# Verify the fix is present in your Zephyr source tree
cd zephyr
git log --oneline drivers/flash/flash_sf32lb_mpi_qspi_nor.c | grep 909eb568
grep -n "qspi_nor_range_is_valid" drivers/flash/flash_sf32lb_mpi_qspi_nor.c
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
