CVE-2026-19569: Zephyr RTOS Dynamic Object RCE Vulnerability

CVE-2026-19569 Overview

CVE-2026-19569 is an integer overflow vulnerability [CWE-190] in the Zephyr real-time operating system (RTOS). The flaw resides in dynamic_object_create() within kernel/userspace/userspace.c, where size arithmetic for dynamically allocated kernel objects wraps around without bounds checking. An unprivileged user-mode thread can supply a size close to SIZE_MAX, causing the kernel to hand out an undersized heap chunk while still registering a full-sized kernel object descriptor. The result is a supervisor-mode out-of-bounds write into the kernel resource-pool heap, enabling escape from the CONFIG_USERSPACE sandbox.

Critical Impact
An unprivileged user thread can corrupt kernel heap metadata and adjacent kernel objects, achieving kernel-level code execution and full system compromise on affected Zephyr builds.

Affected Products

Zephyr RTOS builds with CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled
Zephyr RTOS builds with CONFIG_DYNAMIC_THREAD enabled under userspace
Zephyr RTOS builds with CONFIG_GEN_PRIV_STACKS (additional wild-pointer exposure in the thread-stack branch)

Discovery Timeline

2026-10-09 - CVE CVE-2026-19569 published to the National Vulnerability Database (NVD)
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-19569

Vulnerability Analysis

The vulnerability stems from unchecked arithmetic in two allocation paths. For generic kernel objects, dynamic_object_create() computes the backing allocation as obj_size_get(otype) + size. For thread stack elements, it uses STACK_ELEMENT_DATA_SIZE(size), which performs a round-up plus fixed overhead. Neither expression validates for unsigned wrap-around.

When a caller supplies a size near SIZE_MAX, the computed total wraps to a small value. The kernel then allocates a few bytes from the heap but still tags the object descriptor with the full requested type and registers it in the kernel object table. Subsequent initialization syscalls such as k_mutex_init(), k_sem_init(), or k_thread_create() write a complete object over the truncated allocation, overflowing adjacent sys_heap chunk metadata and kernel objects.

Root Cause

The size argument flows directly from user mode into the arithmetic. k_object_alloc_size() is declared __syscall in include/zephyr/sys/kobject.h, and its verifier z_vrfy_k_object_alloc_size() in kernel/userspace/userspace_handler.c is a bare pass-through. The internal z_object_alloc() only range-checks otype and does not bound size. Kernel-object validation macros K_SYSCALL_OBJ_INIT() and K_SYSCALL_OBJ_NEVER_INIT() check only type and initialization state, not the actual backing-buffer size.

Attack Vector

An attacker needs a user-mode thread with an assigned resource pool. The thread invokes k_object_alloc_size() or k_thread_stack_alloc() with a crafted size that triggers wrap-around. The returned handle passes all subsequent object validation. The matching init syscall then writes a full object into the undersized chunk, corrupting heap metadata or adjacent descriptors. Under CONFIG_GEN_PRIV_STACKS, the thread-stack branch additionally stores an attacker-influenced wild pointer as a user thread's privileged stack base, giving direct control of supervisor execution.

 		}
 
 		adjusted_size = STACK_ELEMENT_DATA_SIZE(size);
+		if (adjusted_size < size) {
+			/* The size adjustment above overflowed, which would
+			 * hand out an allocation smaller than requested.
+			 */
+			k_free(dyn);
+			return NULL;
+		}
+
 		dyn->data = z_thread_aligned_alloc(DYN_OBJ_DATA_ALIGN_K_THREAD_STACK,
 						     adjusted_size);
 		if (dyn->data == NULL) {

Source: Zephyr Commit 85c1c4c21945d9b8fcef03216f1ccb2b27794e3d. The patch adds an overflow check comparing adjusted_size against the original size and frees the partially built descriptor on wrap-around.

Detection Methods for CVE-2026-19569

Indicators of Compromise

Unexpected sys_heap corruption faults or kernel panics shortly after user-mode allocation syscalls
User-mode threads invoking k_object_alloc_size() or k_thread_stack_alloc() with size arguments near SIZE_MAX
Privileged stack base pointers for user threads referencing addresses outside the resource pool range

Detection Strategies

Instrument the Zephyr kernel to log size arguments entering dynamic_object_create() and alert on values exceeding plausible object sizes
Enable CONFIG_SYS_HEAP_VALIDATE or equivalent heap integrity checks to catch chunk-metadata corruption at runtime
Audit firmware images for the vulnerable dynamic_object_create() implementation prior to the upstream fix

Monitoring Recommendations

Monitor device telemetry for repeated kernel exceptions, MPU faults, or unexpected resets following syscall activity
Track firmware versions across deployed fleets and flag builds predating commit 85c1c4c
Review userspace application code for calls that pass externally derived sizes into dynamic object allocation APIs

How to Mitigate CVE-2026-19569

Immediate Actions Required

Apply the upstream Zephyr patch from commit 85c1c4c21945d9b8fcef03216f1ccb2b27794e3d and rebuild all affected firmware images
Inventory devices running Zephyr with CONFIG_USERSPACE plus CONFIG_DYNAMIC_OBJECTS or CONFIG_DYNAMIC_THREAD enabled
Prioritize patch deployment on devices that execute untrusted or third-party user-mode code

Patch Information

The fix in Zephyr commit 85c1c4c rejects both overflowing computations in dynamic_object_create() and frees the partially built descriptor when wrap-around is detected. See the GitHub Security Advisory GHSA-fg8c-9fhq-q7hv for the full advisory.

Workarounds

Disable CONFIG_DYNAMIC_OBJECTS and CONFIG_DYNAMIC_THREAD where application design permits static allocation only
Remove or restrict assigned resource pools for untrusted user-mode threads, since exploitation requires a calling thread with a resource pool
Wrap k_object_alloc_size() and k_thread_stack_alloc() call sites in application-level size validation before invoking the syscall

bash

# Disable dynamic object allocation in Zephyr prj.conf as a workaround
CONFIG_DYNAMIC_OBJECTS=n
CONFIG_DYNAMIC_THREAD=n