CVE-2026-17053: Zephyr SMBus Privilege Escalation Vulnerability

CVE-2026-17053 Overview

CVE-2026-17053 is a missing authorization vulnerability [CWE-862] in the Zephyr real-time operating system (RTOS). The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls without validating the caller-supplied struct smbus_callback *cb pointer. An unprivileged user-mode thread granted access to the SMBus device object can unregister callbacks installed by supervisor-mode components, silently disabling SMBALERT or Host Notify handling.

Critical Impact
Unprivileged threads can unregister supervisor-registered SMBus callbacks, disabling alert handling system-wide and triggering kernel-mode faults through supervisor-mode pointer dereference.

Affected Products

Zephyr RTOS builds with CONFIG_USERSPACE=y and CONFIG_SMBUS=y
drivers/smbus/intel_pch_smbus.c with CONFIG_SMBUS_INTEL_PCH_SMBALERT or CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY
drivers/smbus/smbus_stm32.c with CONFIG_SMBUS_STM32_SMBALERT

Discovery Timeline

2026-10-01 - CVE-2026-17053 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-17053

Vulnerability Analysis

The vulnerability resides in the syscall verifiers inside drivers/smbus/smbus_handlers.c. The verifiers for smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() only validated the dev argument using K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS). The caller-supplied callback pointer was forwarded directly into kernel-mode driver code without any K_SYSCALL_MEMORY_READ or K_SYSCALL_MEMORY_WRITE validation.

The pointer eventually reaches smbus_callback_remove() in drivers/smbus/smbus_utils.h, where it serves as a node identity against the kernel's sys_slist_t of registered callbacks. A 2023 change already removed the matching set_cb() syscalls for the same reason, but the removal syscalls remained exposed.

Root Cause

The root cause is missing memory validation in the syscall verifiers. Only the device object was authenticated; the callback pointer was treated as trusted. Because Zephyr images use fixed symbol addresses and the syscall returns 0 on a hit versus -ENOENT on a miss, the target callback address is both derivable and searchable from user mode.

Attack Vector

An unprivileged thread with access to the SMBus device object invokes the removal syscall with an arbitrary pointer. On a successful match, the supervisor-registered callback is removed, silently disabling alert handling. In builds with CONFIG_ASSERT=y, the __ASSERT(callback->handler, ...) check dereferences the caller-supplied address in supervisor mode. A bogus pointer raises a kernel-mode fault, and the fault outcome discloses which addresses are mapped.

// Vulnerable verifiers removed by the fix (drivers/smbus/smbus_handlers.c)
static inline int z_vrfy_smbus_smbalert_remove_cb(const struct device *dev,
                                                  struct smbus_callback *cb)
{
    K_OOPS(K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS));

    return z_impl_smbus_smbalert_remove_cb(dev, cb);
}

static inline int z_vrfy_smbus_host_notify_remove_cb(const struct device *dev,
                                                     struct smbus_callback *cb)
{
    K_OOPS(K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS));

    return z_impl_smbus_host_notify_remove_cb(dev, cb);
}

Source: GitHub Commit 331df881

Detection Methods for CVE-2026-17053

Indicators of Compromise

Unexpected kernel-mode faults or fatal system errors originating from SMBus driver code paths in smbus_callback_remove().
Loss of SMBALERT or Host Notify event handling in builds that previously registered callbacks from supervisor-mode code.
User-mode threads invoking smbus_smbalert_remove_cb() or smbus_host_notify_remove_cb() syscalls that they did not originally install.

Detection Strategies

Audit Zephyr firmware builds for CONFIG_USERSPACE=y combined with CONFIG_SMBUS=y and either Intel PCH or STM32 SMBus driver configurations.
Review which user-mode threads have been granted the SMBus device object via k_object_access_grant() and verify that privilege is strictly required.
Inspect source for calls to the two removal functions originating in user-mode code paths.

Monitoring Recommendations

Instrument firmware logs to capture syscall-origin kernel faults and correlate them with the calling thread identifier.
Monitor system health signals that depend on SMBus alerts (thermal, power, hot-swap events) for silent loss of notifications.

How to Mitigate CVE-2026-17053

Immediate Actions Required

Apply the upstream Zephyr patch from commit 331df881a8b8cb4296699a8251c9fd74a4308f3d to firmware builds that enable SMBus with userspace support.
Audit granted SMBus device object access and revoke it from user-mode threads that do not require it.
Rebuild and reflash affected devices after integrating the fix.

Patch Information

The fix removes both syscall entry points, demoting smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() to ordinary static inline calls. Callback list manipulation is now available only to supervisor-mode code. See the GitHub Security Advisory GHSA-hqh5-956f-5x2r and the upstream commit.

Workarounds

Disable CONFIG_USERSPACE where feasible; the vulnerability has no impact on builds without userspace enabled.
Disable SMBus driver features that implement callbacks (CONFIG_SMBUS_INTEL_PCH_SMBALERT, CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, CONFIG_SMBUS_STM32_SMBALERT) if they are not required.
Restrict SMBus device object grants so that only trusted supervisor-adjacent threads hold access.

bash

# Example: remove SMBus callback features from a Zephyr prj.conf
# CONFIG_SMBUS_INTEL_PCH_SMBALERT is not set
# CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY is not set
# CONFIG_SMBUS_STM32_SMBALERT is not set