CVE-2026-19569

Executive Summary

CVE-2026-19569 is an unsigned integer wrap-around vulnerability (CWE-190) in the Zephyr RTOS kernel's userspace object allocation subsystem, specifically within dynamic_object_create() in kernel/userspace/userspace.c. Unprivileged user-mode threads can reach the vulnerable arithmetic directly through the k_object_alloc_size() syscall (or indirectly via k_thread_stack_alloc()), supplying a size near SIZE_MAX that causes a heap allocation to underflow to a few bytes while the object descriptor retains the full requested type. The subsequent initialization syscall then performs a supervisor-mode out-of-bounds write into the kernel resource-pool heap, enabling privilege escalation, memory corruption, and arbitrary kernel object manipulation.

Technical Analysis

The vulnerability resides in how dynamic_object_create() computes backing allocation sizes for dynamically allocated kernel objects. For standard kernel objects, the allocation is calculated as obj_size_get(otype) + size; for thread stack elements, it uses STACK_ELEMENT_DATA_SIZE(size) (a round-up plus fixed overhead). Neither expression is validated for unsigned integer wrap-around before being passed to the heap allocator.

When a caller supplies a size value close to SIZE_MAX, the addition or macro expansion wraps to a very small integer — a few bytes. The kernel heap (k_heap-backed resource pool) therefore hands out a truncated chunk. Critically, the object descriptor is still tagged with the full requested object type and registered in the kernel object table. Because the object table entry reflects the intended type, subsequent validation checks (K_SYSCALL_OBJ_INIT() / K_SYSCALL_OBJ_NEVER_INIT()) only verify the object's declared type and initialization state — not the actual allocated size — so the undersized handle passes verification.

The attack surface is exposed directly to user mode. k_object_alloc_size() is declared __syscall in include/zephyr/sys/kobject.h, and its verifier z_vrfy_k_object_alloc_size() in kernel/userspace/userspace_handler.c is a bare pass-through with no bounds checking on size. Additionally, z_object_alloc() only range-checks the object type (otype), leaving size entirely unbounded. The stack-element branch of the same arithmetic is reachable through the k_thread_stack_alloc() syscall via kernel/dynamic.c, widening the reachable code paths.

The consequence is a classic heap-based out-of-bounds write: the matching initialization syscall — for example k_mutex_init(), k_sem_init(), or k_thread_create() — writes a complete object structure over the truncated allocation, overflowing into adjacent kernel resource-pool heap memory. This is a supervisor-mode write of attacker-influenced size and content, executed on behalf of an unprivileged user-mode thread. The S:C (Scope: Changed) CVSS rating reflects that the compromise of the kernel object subsystem impacts components beyond the vulnerable function itself.

The root cause aligns with CWE-190: the arithmetic is performed without detection or prevention of integer overflow. The high AC:L and PR:L (Low privilege) values indicate the flaw is straightforward to trigger from an already-existing unprivileged user-mode context, requiring no special conditions.

Exploitation Scenarios

No public proof-of-concept is available. The attack chain below is inferred from the vulnerability class (unsigned integer wrap-around leading to heap truncation and out-of-bounds write) and the code paths documented in the NVD description.

1. Reconnaissance / target identification. The adversary identifies a Zephyr-based device or firmware image that exposes user-mode threads (i.e., built with CONFIG_USERSPACE=y). This is common in IoT, industrial, and embedded products running Zephyr with multi-threaded unprivileged application logic. The attacker must already possess the ability to run code in an unprivileged user-mode thread — for example through a malicious or compromised application running on the device.

2. Triggering the flaw class. From within the unprivileged thread, the attacker invokes the k_object_alloc_size() syscall (or the k_thread_stack_alloc() syscall for the stack-element branch) with a size argument set close to SIZE_MAX. The pass-through verifier z_vrfy_k_object_alloc_size() forwards the value unchecked; z_object_alloc() validates only otype. The unsigned arithmetic in dynamic_object_create() wraps, producing a tiny allocation while the kernel object table registers a descriptor of the full requested type.

3. Payload / execution method (class level). The attacker then calls the matching initialization syscall for the requested object type — such as k_mutex_init(), k_sem_init(), or k_thread_create(). Because K_SYSCALL_OBJ_INIT()/K_SYSCALL_OBJ_NEVER_INIT() validate only type and initialization state, the call is accepted and a full object structure is written over the truncated allocation. This produces a supervisor-mode out-of-bounds heap write whose size and content are substantially attacker-controlled.

4. Post-exploitation impact. The overflow corrupts adjacent kernel resource-pool heap memory, potentially allowing the attacker to manipulate kernel object metadata, hijack kernel data structures, or achieve code execution in supervisor mode. Given the S:C scope change and High confidentiality/integrity/availability ratings, successful exploitation can lead to full device compromise, persistent firmware-level control, and lateral movement or denial of service across the affected device fleet.

Impact Assessment

CVE-2026-19569 carries a CVSS v3.1 base score of 8.8 (High), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The local attack vector (AV:L) reflects that the attacker must already be executing code in a user-mode thread on the target. Low attack complexity (AC:L) and low privileges required (PR:L) mean the flaw is reliably triggerable by any unprivileged user-mode context — a significant risk for multi-tenant or app-isolated embedded deployments. No user interaction is required (UI:N).

The Scope:Changed (S:C) rating indicates that a successful exploit crosses a security boundary — from user mode into the kernel supervisor domain — impacting resources beyond the vulnerable component. Confidentiality, Integrity, and Availability impacts are all rated High (C:H/I:H/A:H) because the resulting out-of-bounds write into the kernel heap can corrupt kernel object metadata, potentially leading to arbitrary code execution, privilege escalation to supervisor mode, and system instability or crash.

Affected systems are Zephyr RTOS deployments built with userspace support. Because Zephyr is widely used in IoT sensors, industrial controllers, medical devices, and consumer embedded products, the blast radius can extend across entire device fleets where a single compromised application thread shares the kernel. No CISA KEV listing exists, and no public exploit code or PoC has been observed, so the immediate in-the-wild risk is lower — but the severity for any environment that permits unprivileged user-mode execution is high, particularly where devices are remotely updateable or run third-party application code.

Detection Guidance

Sigma Rule

title: Zephyr RTOS k_object_alloc_size Integer Wrap-Around Exploitation Attempt
id: 8f3c2a91-4b7e-4d2f-9c1a-7e6b5d4c3a21
status: experimental
description: Detects invocation of the Zephyr k_object_alloc_size or k_thread_stack_alloc syscall with a size argument near SIZE_MAX, consistent with CVE-2026-19569 unsigned wrap-around abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19569
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection_syscall:
    type: 'SYSCALL'
    syscall|contains:
      - 'k_object_alloc_size'
      - 'k_thread_stack_alloc'
  selection_size:
    a2|startswith:
      - '0xffffffffffff'
      - '0xffffffffffffff'
  condition: selection_syscall and selection_size
falsepositives:
  - Legitimate applications requesting maximal stack sizes (unlikely)
level: high

YARA Rule

rule CVE_2026_19569_Zephyr_Object_Alloc_Wraparound
{
    meta:
        description = "Detects firmware artifacts or exploit binaries referencing vulnerable Zephyr userspace object allocation paths (CVE-2026-19569)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19569"
        severity = "high"
    strings:
        $s1 = "k_object_alloc_size" ascii
        $s2 = "z_vrfy_k_object_alloc_size" ascii
        $s3 = "dynamic_object_create" ascii
        $s4 = "k_thread_stack_alloc" ascii
        $s5 = "STACK_ELEMENT_DATA_SIZE" ascii
        $s6 = "z_object_alloc" ascii
    condition:
        uint32be(0) == 0x7F454C46 or
        (2 of ($s*))
}

Suricata IDS Rule

alert udp any any -> any any (msg:"CVE-2026-19569 Zephyr RTOS k_object_alloc_size Integer Wrap-Around Attempt"; content:"k_object_alloc_size"; nocase; content:"0xffffffffffffffff"; nocase; classtype:attempted-admin; sid:2026195690; rev:1; reference:cve,CVE-2026-19569; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Note: Exploitation is local (user-mode syscall), so network IDS visibility is limited. The rule above targets debug/telemetry channels or network-exposed syscall proxies where such invocations may transit.

Elastic Detection

process where event.type == "start" and
  process.args : ("k_object_alloc_size", "k_thread_stack_alloc") and
  process.args : ("0xffffffffffffffff", "18446744073709551615")

Splunk SPL Query

index=main (sourcetype=auditd OR sourcetype=syslog)
| search ("k_object_alloc_size" OR "k_thread_stack_alloc" OR "dynamic_object_create")
| search ("0xffffffffffffffff" OR "18446744073709551615" OR "SIZE_MAX")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, user
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="zephyr,cve-2026-19569,">
  <rule id="100569" level="12">
    <decoded_as>json</decoded_as>
    <field name="syscall">k_object_alloc_size|k_thread_stack_alloc</field>
    <field name="size">^0xffffffffffffffff$|^18446744073709551615$</field>
    <description>CVE-2026-19569: Potential Zephyr RTOS integer wrap-around exploitation via object allocation syscall with SIZE_MAX-like argument.</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>exploit_attempt,pci_dss_10.2.4,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no vendor patch available):

   • Disable user-mode support (CONFIG_USERSPACE) on Zephyr builds if the application does not strictly require it, removing the vulnerable syscall surface.
   • Where CONFIG_USERSPACE must remain enabled, restrict which unprivileged threads are permitted to invoke k_object_alloc_size() and k_thread_stack_alloc() via kernel object permission policies and thread privilege levels.
   • Apply compile-time hardening: enable stack/heap canaries, memory protection (CONFIG_MPU/CONFIG_MMU), and bounds-checking options in the Zephyr configuration to detect and contain the out-of-bounds write.
   • Monitor firmware images and application code for calls passing extreme size values (near SIZE_MAX) to these syscalls.

2. Patch / upgrade steps:

   • No vendor fix is currently available. Track the Zephyr project security advisories and NVD entry for CVE-2026-19569 for an upstream patch.
   • Once a patched Zephyr release is published, upgrade affected firmware images and rebuild all downstream products that incorporate the vulnerable kernel.
   • Verify the fix adds explicit check for unsigned overflow (or validates that size <= SIZE_MAX - obj_size_get(otype)) before allocation in dynamic_object_create() and bounds-checks size in z_vrfy_k_object_alloc_size().

3. Long-term hardening:

   • Adopt integer-overflow-safe arithmetic helpers (e.g., __builtin_add_overflow) in kernel allocation paths and enforce fuzz testing of syscall verifiers.
   • Implement mandatory bounds checking in all z_vrfy_* syscall verifier functions, not just validation of object type.
   • Incorporate runtime object-size consistency checks so that the registered kernel object table entry cannot diverge from the actual allocated backing chunk.
   • Maintain a firmware SBOM to rapidly identify embedded fleets running Zephyr with userspace enabled when future kernel CVEs are disclosed.

References

• NVD — CVE-2026-19569: https://nvd.nist.gov/vuln/detail/CVE-2026-19569
• Zephyr Project Security Advisories: https://github.com/zephyrproject-rtos/zephyr/security/advisories
• Zephyr Project Documentation — Kernel Objects / Userspace: https://docs.zephyrproject.org/latest/kernel/usermode/index.html
• MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• CWE-190 — Integer Overflow or Wraparound: https://cwe.mitre.org/data/definitions/190.html

No CISA KEV listing, public PoC, or exploit-in-the-wild evidence is currently associated with CVE-2026-19569.