CVE-2026-17053

Executive Summary

CVE-2026-17053 is a missing-authorization flaw in the Zephyr RTOS SMBus driver subsystem, where the removal syscalls smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() were exposed to user-mode threads while validating only the dev argument and never validating the caller-supplied struct smbus_callback *cb pointer or the memory it references. On affected builds (CONFIG_USERSPACE=y, CONFIG_SMBUS=y, with a driver implementing SMBALERT/Host Notify callbacks), any unprivileged thread holding the SMBus device object can unregister a supervisor-mode callback — silently disabling system-wide alert handling — and, because the syscall returns 0 on a hit versus -ENOENT on a miss while Zephyr images have fixed symbol addresses, the same primitive acts as a kernel memory-address oracle. Impact is limited to integrity and availability (CVSS 4.4, local, low privileges), with no confidentiality impact and no public exploit code or CISA KEV listing at time of writing.

Technical Analysis

The vulnerability resides in the Zephyr SMBus driver API implementation and its syscall verification layer.

Exposed attack surface. Two syscalls — smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() — were left callable from user mode. Their verifiers in drivers/smbus/smbus_handlers.c performed only an object check on the device argument:

• K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS)

Critically, no K_SYSCALL_MEMORY_READ or K_SYSCALL_MEMORY_WRITE validation was applied to the second argument, the caller-supplied struct smbus_callback *cb pointer. That pointer is passed directly into kernel-mode driver code.

Historical context. A companion change in 2023 had already removed the matching setter syscalls — smbus_smbalert_set_cb() and smbus_host_notify_set_cb() — for exactly this reason (missing pointer validation). The two removal syscalls, which share the same unvalidated-pointer handling pattern for the same callback structure, were left exposed by that cleanup. This is a partial-remediation gap rather than a newly introduced defect.

Mechanism. The unvalidated pointer reaches smbus_callback_remove() in drivers/smbus/smbus_utils.h, which uses the supplied value as a node identity against the kernel's sys_slist_t list of registered callbacks. Two consequences follow from this design:

1. Unauthorized unregistration. If the attacker supplies a pointer matching the address of a callback node that a supervisor-mode component registered, smbus_callback_remove() removes that node. The registered SMBALERT or Host Notify handler is then gone, and alert processing for the rest of the system is silently disabled.
2. Address oracle. Zephyr images use fixed symbol addresses, and the syscall's return value differs deterministically: 0 on a successful list hit versus -ENOENT on a miss. By passing candidate pointer values and observing the return code, an unprivileged thread can determine whether a guessed address corresponds to a live callback node — effectively an address-probing primitive against kernel memory layout. The NVD description explicitly notes that the target address is "both derivabl[e]" and confirmable through this differential response.

Required conditions. Successful exploitation requires all of: (a) CONFIG_USERSPACE=y; (b) CONFIG_SMBUS=y; (c) a driver implementing the callback operations — either drivers/smbus/intel_pch_smbus.c with CONFIG_SMBUS_INTEL_PCH_SMBALERT or CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or drivers/smbus/smbus_stm32.c with CONFIG_SMBUS_STM32_SMBALERT; and (d) a user-mode thread that has already been granted the SMBus device object via Zephyr's kernel object permission model. The CVSS vector (AV:L, PR:L) is consistent with this pre-existing device-object grant acting as the privilege precondition.

Authorization failure classification. CWE-862 (Missing Authorization) is the correct mapping: the syscall entry points lacked a required security check on caller-controlled memory, rather than containing a memory-safety bug such as a buffer overflow. The kernel does not dereference arbitrary attacker memory; it treats an attacker-chosen value as a list node identity without verifying that the caller is authorized to remove that node.

What is not established by the available data. No specific struct field offsets, no list traversal implementation details beyond sys_slist_t and smbus_callback_remove(), and no CVE-assigned fix commit or release are available. The disclosed material does not state whether smbus_callback_remove() performs any additional membership or ownership check before unlinking. Automated tooling coverage is absent: no Nuclei template, no public PoC, no vendor advisory, and no OSV package mapping were provided.

Exploitation Scenarios

No public PoC exists; the following chain is inferred from the vulnerability class and the conditions stated in the NVD description. Only identifiers appearing in the supplied description are used.

1) Reconnaissance and target identification. The attacker must already possess a user-mode thread on the device with the SMBus device object granted to it — the K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS) check will otherwise fail the call outright. Reconnaissance therefore consists of establishing that the target firmware was built with CONFIG_USERSPACE=y, CONFIG_SMBUS=y, and one of the qualifying driver configurations (CONFIG_SMBUS_INTEL_PCH_SMBALERT, CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or CONFIG_SMBUS_STM32_SMBALERT), and of obtaining the firmware image so that fixed symbol addresses can be read offline.

2) Triggering the flaw class. The attacker invokes smbus_smbalert_remove_cb() or smbus_host_notify_remove_cb() with the granted device object and an attacker-chosen struct smbus_callback *cb value. The verifier in drivers/smbus/smbus_handlers.c accepts the call because the only check performed is the device-object check; no K_SYSCALL_MEMORY_READ or K_SYSCALL_MEMORY_WRITE validation rejects the pointer. The value is forwarded into kernel-mode driver code.

3) Payload/execution method at the vulnerability-class level. The attacker derives candidate addresses for registered callback nodes from the firmware image's fixed symbol layout, then probes them by passing each candidate as the cb argument and reading the syscall return value: a return of 0 indicates a list hit (the address corresponds to a live node), while -ENOENT indicates a miss. Once a live node address is confirmed, the attacker re-issues the syscall with that value to unlink the node via smbus_callback_remove() in drivers/smbus/smbus_utils.h. No code execution primitive is claimed or required; the primitive is unauthorized state modification plus an address-confirmation oracle.

4) Post-exploitation impact. The supervisor-mode component's SMBALERT or Host Notify callback is removed from the kernel's sys_slist_t, so alert handling is silently disabled for the remainder of the system's runtime. The removal is not inherently noisy — no logging or fault is generated by a successful unlink — and the compromised state persists until reboot. The address oracle additionally leaks layout information that may support follow-on attacks against other syscalls in the same firmware. The attacker gains no confidentiality (CVSS C:N) and no scope change (S:U); integrity and availability are each rated Low (I:L, A:L), reflecting the bounded blast radius of removing alert handling on a constrained device.

Impact Assessment

Direct impact. Loss of SMBus alert processing: SMBALERT and Host Notify callbacks registered by supervisor-mode components are removed, degrading the device's ability to respond to peripheral-originated events such as thermal, power, or fault notifications delivered over SMBus. Because alert handling is silently disabled and the state persists until reboot, the failure mode is a latent loss of monitoring rather than a visible crash.

Secondary impact. A practical kernel memory-address confirmation oracle for unprivileged threads, enabled by fixed symbol addresses in Zephyr images and the deterministic 0-versus--ENOENT return differential. This is information that can be repurposed against other interfaces in the same image.

CVSS subscores (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L — 4.4). Local attack vector and low complexity are consistent with a syscall reachable directly from a local thread. Low privileges (PR:L) reflect the requirement that the SMBus device object already be granted to the calling thread. No user interaction is required. Scope is unchanged (S:U) — the flaw is confined to the Zephyr kernel's authorization model for this subsystem. Confidentiality is Not Impacted (C:N); Integrity and Availability are each rated Low (I:L, A:L) due to the limited, non-persistent-across-reboot nature of the state change.

Blast radius. Constrained to affected Zephyr images that enable userspace and SMBus together with one of the qualifying callback-implementing drivers, and to threads that have been granted the SMBus device object. Systems without CONFIG_USERSPACE=y are not exposed via this path, since the syscall surface is not reachable from user mode. There is no evidence of active exploitation: not in CISA KEV, no public exploit code, no Nuclei template, and no EPSS score assigned by FIRST.org.

Patch status. UNPATCHED. Patch confidence 0/4 — no patch evidence from any tracked source, no vendor fix, no workaround, and no published affected version range. Remediation currently depends on disabling the exposure preconditions or applying an out-of-band source change to the verifiers.

Detection Guidance

Detection for this vulnerability is constrained by its nature: the attack is a sequence of local syscall invocations, not network traffic. The rules below target semantic indicators — repeated failing syscall returns consistent with address probing, and loss of alert-handler registration state — and should be tuned to the specific firmware build under monitoring. Network-layer rules are best-effort and apply only where SMBus alert state is relayed or logged over a management interface.

Sigma Rule

title: Zephyr SMBus Callback Removal Syscall Probing (CVE-2026-17053)
id: 8e2c7d14-9b3f-4a52-9c1e-2f7a6d0b5c31
status: experimental
description: Detects repeated invocation of Zephyr SMBus callback removal syscalls
  returning -ENOENT, consistent with kernel address probing as described in
  CVE-2026-17053. Zephyr targets do not run Windows/Linux EDR agents; this rule is
  intended for firmware instrumentation, host-side UART/console capture, or
  Zephyr syscall tracing aggregated by a log collector.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-17053
author: valtersit.com
date: 2026/01/01
logsource:
  product: zephyr
  service: syscall_trace
detection:
  selection_syscall:
    syscall|contains:
      - 'smbus_smbalert_remove_cb'
      - 'smbus_host_notify_remove_cb'
  selection_result_miss:
    return_value|contains:
      - 'ENOENT'
      - '-2'
  selection_result_hit:
    return_value: '0'
  timeframe: 5m
  condition: selection_syscall and (selection_result_miss | count() by thread_id > 10) or (selection_syscall and selection_result_hit)
falsepositives:
  - Legitimate driver or supervisor component unregistering its own callback
  - Diagnostic or test harnesses exercising the SMBus callback API
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-17053

YARA Rule

rule CVE_2026_17053_Zephyr_SMBus_Remove_Syscall
{
    meta:
        description = "Detects Zephyr firmware images exposing the unvalidated SMBus callback removal syscalls described in CVE-2026-17053"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-17053"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $syscall_a = "smbus_smbalert_remove_cb" ascii fullword
        $syscall_b = "smbus_host_notify_remove_cb" ascii fullword
        $handler   = "smbus_handlers.c" ascii
        $util      = "smbus_utils.h" ascii
        $dev_check = "K_SYSCALL_OBJ" ascii
        $driver_a  = "intel_pch_smbus" ascii
        $driver_b  = "smbus_stm32" ascii
        $cfg_a     = "CONFIG_SMBUS_INTEL_PCH_SMBALERT" ascii
        $cfg_b     = "CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY" ascii
        $cfg_c     = "CONFIG_SMBUS_STM32_SMBALERT" ascii

    condition:
        uint32(0) == 0x544F4F42 or
        (
            any of ($syscall_a, $syscall_b) and
            (any of ($handler, $util, $dev_check)) and
            (any of ($driver_a, $driver_b, $cfg_a, $cfg_b, $cfg_c))
        )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-17053 Zephyr SMBus Callback Removal Syscall Reference Observed in Cleartext Management Channel"; flow:established,to_server; content:"smbus_smbalert_remove_cb"; nocase; sid:2026170531; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-17053, affected_product Zephyr_RTOS, attack_target IoT, deployment Perimeter, signature_severity Minor, tag CVE_2026_17053; classtype:attempted-recon;)
alert tcp any any -> any any (msg:"CVE-2026-17053 Zephyr SMBus Host Notify Callback Removal Syscall Reference Observed in Cleartext Management Channel"; flow:established,to_server; content:"smbus_host_notify_remove_cb"; nocase; sid:2026170532; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-17053, affected_product Zephyr_RTOS, attack_target IoT, deployment Perimeter, signature_severity Minor, tag CVE_2026_17053; classtype:attempted-recon;)

Elastic Detection

process where event.type == "start" or event.category == "process"
// Zephyr devices report via host-side console capture, UART bridges, or
// firmware test harnesses piped into Elastic. Match on syscall trace text.
and (
  process.command_line : "smbus_smbalert_remove_cb"
  or process.command_line : "smbus_host_notify_remove_cb"
  or process.args : "smbus_smbalert_remove_cb"
  or process.args : "smbus_host_notify_remove_cb"
)
and (
  process.command_line : "-ENOENT"
  or process.command_line : "ENOENT"
  or process.args : "ENOENT"
)

Sequence variant for repeated probing (returns a hit after many misses):

sequence by host.id, process.parent.pid with maxspan=5m
  [ any where process.command_line : "smbus_*_remove_cb" and process.command_line : "ENOENT" ]
  [ any where process.command_line : "smbus_*_remove_cb" ]

Splunk SPL Query

index=firmware_telemetry (sourcetype=zephyr:console OR sourcetype=zephyr:syscall_trace OR sourcetype=uart:capture)
("smbus_smbalert_remove_cb" OR "smbus_host_notify_remove_cb")
| eval probe_miss=if(match(_raw,"(?i)ENOENT|-2"),1,0)
| eval probe_hit=if(match(_raw,"(?i)return(ed)?\s*0\b|ret\s*=\s*0"),1,0)
| stats count AS invocations sum(probe_miss) AS misses sum(probe_hit) AS hits values(host) AS hosts BY thread_id device_id
| where misses > 10 OR hits > 0
| sort - misses
| table thread_id device_id hosts invocations misses hits

Wazuh OSSEC Rule

<group name="zephyr,cve_2026_17053,">
  <rule id="2026170530" level="0">
    <decoded_as>zephyr</decoded_as>
    <match>smbus_smbalert_remove_cb|smbus_host_notify_remove_cb</match>
    <description>CVE-2026-17053: Zephyr SMBus callback removal syscall referenced (baseline)</description>
  </rule>

  <rule id="2026170531" level="3">
    <if_sid>2026170530</if_sid>
    <match>ENOENT</match>
    <description>CVE-2026-17053: Zephyr SMBus callback removal syscall returned -ENOENT (possible address probing)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_17053,recon,</group>
  </rule>

  <rule id="2026170532" level="8" frequency="2" timeframe="300">
    <if_sid>2026170531</if_sid>
    <same_field>thread_id</same_field>
    <description>CVE-2026-17053: Repeated -ENOENT returns from Zephyr SMBus callback removal syscall by the same thread (active address probing)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_17053,exploit_attempt,</group>
  </rule>

  <rule id="2026170533" level="10">
    <if_sid>2026170530</if_sid>
    <regex>return(ed)?\s*=?\s*0\b</regex>
    <description>CVE-2026-17053: Zephyr SMBus callback removal syscall returned 0 (callback successfully unregistered, possible alert suppression)</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
    <group>cve_2026_17053,alert_suppression,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no workaround, and no affected version range have been published. The guidance below addresses exposure preconditions and source-level hardening based strictly on the configuration and code paths named in the NVD description.

1) Immediate mitigations.

• Remove the exposure precondition where the application can function without it: building with CONFIG_USERSPACE=n eliminates reachability of the affected syscall surface from user-mode threads, at the cost of losing memory-domain isolation.
• If CONFIG_SMBUS=n is viable for the product, do so; the two syscalls are unreachable without the SMBus subsystem.
• Where userspace and SMBus are both required, stop granting the SMBus device object (K_OBJ_DRIVER_SMBUS) to unprivileged threads that do not strictly need it. The verifier's device-object check is the only gate on these syscalls, so the device-object grant is the effective authorization boundary.
• Where SMBALERT or Host Notify handling is not required, avoid enabling the callback-implementing driver configurations named in the description (CONFIG_SMBUS_INTEL_PCH_SMBALERT, CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, CONFIG_SMBUS_STM32_SMBALERT) until a fix is available.
• Monitor console/UART output and any syscall trace facility for repeated -ENOENT returns and for 0 returns from the two removal syscalls, which indicate probing or successful unregistration respectively.

2) Patch/upgrade steps.

• No patch exists. Do not represent any current release as fixed; the affected version range itself is unpublished.
• Track Zephyr security advisories for a fix that either restores the 2023 treatment of the setter syscalls ("removed for this reason") across the removal syscalls, or adds K_SYSCALL_MEMORY_READ / K_SYSCALL_MEMORY_WRITE validation to the verifiers in drivers/smbus/smbus_handlers.c for the struct smbus_callback *cb argument.
• If applying an out-of-band fix from source, preserve the same validation pattern already in use for other pointer-taking syscalls in the tree and re-verify that the sibling setter syscalls are not exposed; this CVE arose from an incomplete prior cleanup, so scope any patch to the whole callback-management API family rather than the two named syscalls alone.

3) Long-term hardening.

• Enforce a code-review policy requiring that every syscall accepting a caller-supplied pointer includes matching K_SYSCALL_MEMORY_READ/K_SYSCALL_MEMORY_WRITE annotations, and treat the absence of such annotations on pointer arguments as a blocking defect.
• Add automated static checks or CI greps that enumerate all K_SYSCALL_OBJ-only verifiers with pointer parameters, to catch partial remediations like the one that produced this CVE.
• Treat callback registration and removal as a privileged operation: require a distinct capability or an explicit ownership check in smbus_callback_remove() rather than relying on node-identity matching, so that even an authorized caller cannot remove another component's callback.
• Reduce address-probing utility by avoiding unnecessary reliance on fixed, image-global symbol addresses for authorization-relevant state where the platform permits relocation, and by ensuring syscall error paths do not leak hit/miss distinction to unprivileged callers.
• Maintain a firmware SBOM and configuration manifest so that exposure preconditions (CONFIG_USERSPACE, CONFIG_SMBUS, driver and alert configuration flags) are auditable across the deployed fleet.

References

• NVD — CVE-2026-17053: https://nvd.nist.gov/vuln/detail/CVE-2026-17053
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• Zephyr Project security advisories (monitor for an assigned fix): https://github.com/zephyrproject-rtos/zephyr/security/advisories
• Zephyr Project documentation — SMBus driver API and syscall verification model: https://docs.zephyrproject.org/latest/hardware/peripherals/smbus.html
• MITRE ATT&CK — T1068, Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/

Threat actor and exploit-in-the-wild status. No evidence of exploitation in the wild. CVE-2026-17053 is not listed in CISA KEV. No public proof-of-concept, no Nuclei template, and no exploit code were identified; EPSS has not been scored by FIRST.org. No threat actor campaign has been attributed.