CVE-2026-12235 Overview
CVE-2026-12235 is an out-of-bounds write vulnerability [CWE-787] in the Zephyr RTOS Linkable Loadable Extensions (llext) subsystem. The flaw resides in llext_link_plt() within subsys/llext/llext_link.c. The relocatable branch used for Xtensa partially-linked ELF objects fails to validate rela.r_offset before performing the relocation write. An attacker who supplies a crafted ELF extension can trigger a supervisor-context write at an arbitrary offset outside the extension's text buffer. Because llext is documented to accept extensions of untrusted origin, this becomes reachable whenever an application loads an attacker-influenced extension on Xtensa with writable storage.
Critical Impact
Attacker-influenced out-of-bounds write in supervisor context at link time, enabling memory corruption and a sandbox-boundary escape for user-mode extensions.
Affected Products
- Zephyr RTOS llext subsystem (subsys/llext/llext_link.c)
- Xtensa targets using the relocatable PLT path
- Applications loading ELF extensions from writable storage
Discovery Timeline
- 2026-08-12 - CVE-2026-12235 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-12235
Vulnerability Analysis
The vulnerability affects the relocatable branch of llext_link_plt(), the code path taken for Xtensa relocatable objects when tgt != NULL. This branch computes the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and writes the resolved symbol address at that location. The sibling shared/dynamic branch validates offsets using llext_file_offset(), but the relocatable branch performs no bounds check on rela.r_offset.
Because rela.r_offset is read directly from the ELF RELA table, an attacker controls both the write location and, via symbol resolution, the value written. The write executes in supervisor context at link time before any extension code runs. Exploitation requires the Xtensa relocatable PLT path and writable storage, and converting the out-of-range write into a reliable primitive is non-trivial.
Root Cause
The relocatable branch omits the range check that its sibling shared/dynamic branch already implements. No validation ensures rela.r_offset falls inside the target section before the write.
Attack Vector
An attacker crafts an ELF extension containing a RELA entry whose r_offset exceeds the target section size. When an application calls llext_load() on Xtensa with writable storage, the malformed entry drives a supervisor-mode write outside the extension's text buffer, corrupting kernel memory.
}
if (ret != 0) {
- LOG_ERR("PLT: failed to read RELA #%u, trying to continue", i);
+ LOG_WRN("PLT: failed to read RELA #%u, trying to continue", i);
continue;
}
Source: Zephyr commit 106540afbd22087ad40b90f53fb22657754a719e. The upstream patch adds a bound check that rejects any RELA entry where r_offset >= tgt->sh_size, mirroring the validation already present in the shared branch.
Detection Methods for CVE-2026-12235
Indicators of Compromise
- ELF extension files containing RELA entries with r_offset values that exceed the target section size (sh_size).
- Unexpected llext link-time failures or supervisor-context crashes on Xtensa devices after loading third-party extensions.
- Presence of extension binaries sourced from untrusted or writable storage locations on production firmware.
Detection Strategies
- Statically inspect ELF extensions before deployment, parsing the RELA table and verifying each r_offset is within the referenced section.
- Monitor firmware build pipelines for the vulnerable Zephyr commit range and confirm the llext_link_plt() bound-check patch is applied.
- Enable and review llext subsystem logs for warnings emitted from the PLT relocation loop, which may indicate malformed extensions.
Monitoring Recommendations
- Track integrity of the storage medium where extensions are stored, flagging unauthorized writes or modifications.
- Alert on repeated device resets or watchdog events that coincide with extension loading activity.
How to Mitigate CVE-2026-12235
Immediate Actions Required
- Apply the upstream Zephyr patch that adds the r_offset >= tgt->sh_size bound check in llext_link_plt().
- Restrict extension loading on Xtensa devices to signed, trusted binaries only.
- Audit deployed devices to identify those using the llext subsystem with writable extension storage.
Patch Information
The fix is available in Zephyr via commit 106540afbd22087ad40b90f53fb22657754a719e. Refer to the GHSA-xv9q-6mrf-8j49 security advisory for coordinated disclosure details and affected version ranges.
Workarounds
- Disable the llext subsystem on Xtensa targets if extension loading is not required by the application.
- Move extension storage to read-only media to prevent tampering with ELF files after provisioning.
- Validate ELF RELA entries in application code before invoking llext_load(), rejecting any entry whose r_offset exceeds the target section size.
# Verify the patch is present in your Zephyr tree
cd zephyr
git log --oneline 106540afbd22087ad40b90f53fb22657754a719e -1
git grep -n "r_offset >= tgt->sh_size" subsys/llext/llext_link.c
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
