CVE-2026-17051: Intel SEDI IPM Buffer Overflow Vulnerability

CVE-2026-17051 Overview

CVE-2026-17051 is an out-of-bounds write vulnerability [CWE-787] in the Zephyr RTOS Intel SEDI inter-processor mailbox (IPM) driver located at drivers/ipm/ipm_sedi.c. The ipm_event_dispose() interrupt handler reads a peer-controlled doorbell register and extracts a 10-bit payload length that can reach 1023 bytes. That length is passed directly to sedi_ipc_read_msg(), which copies into incoming_data_buf, a static buffer sized to IPC_DATA_LEN_MAX (128 bytes). The underlying HAL bounds check is a DBG_CHECK that compiles out in production images. A privileged host-side actor with driver-level or raw BAR access can trigger an overflow of up to 895 bytes in interrupt context.

Critical Impact
A peer processor with driver-level access can corrupt kernel .bss memory — including k_sem and k_mutex wait-queue pointers — from interrupt context, producing a reliable kernel crash primitive.

Affected Products

Zephyr RTOS builds including drivers/ipm/ipm_sedi.c prior to commit 74c7d27
Firmware images targeting intel_ish_5_* (Intel Integrated Sensor Hub) platforms
Any Zephyr application registering an IPM receive callback via ipm_register_callback() on affected boards

Discovery Timeline

2026-09-21 - CVE-2026-17051 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-17051

Vulnerability Analysis

The defect lives in the message-in path of ipm_event_dispose(). On a SEDI_IPC_EVENT_MSG_IN event, the driver reads the peer-written doorbell register with sedi_ipc_read_dbl() and derives a length using IPC_HEADER_GET_LENGTH(). Because IPC_HEADER_LENGTH_MASK is 0x03FF, the encoded length can span 0–1023 bytes. The driver then calls sedi_ipc_read_msg() to copy that many bytes into struct ipm_sedi_context.incoming_data_buf, which is only IPC_DATA_LEN_MAX (128) bytes.

The HAL routine relies on DBG_CHECK, a compile-time debug assertion that is absent from production images. No runtime validation remains, so up to 895 bytes overflow into adjacent .bss memory. The first casualties are the k_sem and k_mutex objects belonging to the transmit path. Their wait-queue lists contain self-referential kernel pointers, giving an attacker a data-structure corruption primitive that reliably crashes the kernel.

Root Cause

The root cause is missing input validation on a peer-controlled length field before it is used as a memory copy size. The bounds check was implemented as a debug-only assertion, so a production build performs no length verification between the 10-bit doorbell field and the 128-byte destination buffer.

Attack Vector

Exploitation requires local, high-privilege access to the peer processor across the IPC link. On intel_ish_5_* targets, that peer is the host CPU's ISH driver reachable through the device's memory-mapped BAR window. Host software with driver-level or raw BAR access can write an arbitrary doorbell value and trigger the interrupt handler. The overflow bytes are read from registers following the message window, some of which are themselves peer-programmable, giving partial control over the corrupting content.

	switch (event) {
	case SEDI_IPC_EVENT_MSG_IN:
		if (ipm->rx_msg_notify_cb != NULL) {
-			set_ipm_dev_busy(dev, false);
			sedi_ipc_read_dbl(device, &drbl_in);
			len = IPC_HEADER_GET_LENGTH(drbl_in);
-			sedi_ipc_read_msg(device, ipm->incoming_data_buf, len);
-			ipm->rx_msg_notify_cb(dev,
+			if (len <= IPC_DATA_LEN_MAX) {
+				set_ipm_dev_busy(dev, false);
+				sedi_ipc_read_msg(device, ipm->incoming_data_buf, len);
+				ipm->rx_msg_notify_cb(dev,
					      ipm->rx_msg_notify_cb_data,
					      drbl_in, ipm->incoming_data_buf);
+			} else {
+				LOG_ERR("Invalid DRBL 0x%08x: payload length %u exceeds max %u;"
+					" discarding", drbl_in, len, IPC_DATA_LEN_MAX);
+				(void)sedi_ipc_send_ack_drbl(device, 0);
+			}
		} else {
			LOG_WRN("no handler for ipm new msg");
+			(void)sedi_ipc_send_ack_drbl(device, 0);
		}
		break;

Source: Zephyr commit 74c7d27. The patch rejects any doorbell whose encoded length exceeds IPC_DATA_LEN_MAX, logs the event, and acknowledges the doorbell so the peer is not left waiting.

Detection Methods for CVE-2026-17051

Indicators of Compromise

Zephyr kernel panics or faults originating in interrupt context on the SEDI IPM path.
Corruption of struct ipm_sedi_context fields, particularly k_sem or k_mutex wait-queue pointers hanging near incoming_data_buf.
Post-patch log lines beginning with Invalid DRBL 0x from ipm_sedi.c indicating oversized inbound doorbell values.

Detection Strategies

Audit deployed firmware to confirm whether drivers/ipm/ipm_sedi.c includes the length check introduced in commit 74c7d27.
Instrument the host ISH driver to log outbound doorbell length fields and flag any value greater than 128.
Fuzz the host-to-target IPC link with random doorbell values to surface unpatched Zephyr images before deployment.

Monitoring Recommendations

Forward Zephyr LOG_ERR output from IPM subsystems to a centralized logging pipeline for review.
Track unexpected device resets or watchdog events on intel_ish_5_* targets that correlate with host driver activity.
Monitor host userspace processes that hold CAP_SYS_RAWIO or direct BAR access to the ISH device.

How to Mitigate CVE-2026-17051

Immediate Actions Required

Rebuild affected Zephyr firmware from a tree containing commit 74c7d27 and reflash target devices.
Restrict host-side access to the ISH memory-mapped BAR window to trusted kernel drivers only.
Remove or gate any application that registers an IPM receive callback until the driver is patched.

Patch Information

The upstream fix is delivered in the Zephyr commit 74c7d27925055e8c3c8aef7a9f16cae6a8c64b70 and tracked under GHSA-78p3-4gv3-qjh9. The patch adds an explicit len <= IPC_DATA_LEN_MAX guard around sedi_ipc_read_msg() and acknowledges the doorbell on rejection so the peer does not stall.

Workarounds

Build production images with CONFIG_DEBUG enabled so the HAL's DBG_CHECK bounds assertion is retained (accepting the resulting size and performance cost).
Disable the SEDI IPM driver in Kconfig for boards that do not require inter-processor messaging.
Enforce host OS policies that block unprivileged userspace from mapping the ISH BAR region.

bash

# Verify the patched source is present in a Zephyr checkout
cd zephyr
git log --oneline drivers/ipm/ipm_sedi.c | grep 74c7d27
grep -n "IPC_DATA_LEN_MAX" drivers/ipm/ipm_sedi.c