Zephyr Project RTOS: Batch of 3 Vulnerabilities Disclosed, One High Severity
Key findings • Three vulnerabilities in the Zephyr Project RTOS were disclosed on September 21, 2026. • A High severity flaw (CVE-2026-17052) exists in the time-aware GPIO syscall handler due…
Key findings
- Three vulnerabilities in the Zephyr Project RTOS were disclosed on September 21, 2026.
- A High severity flaw (CVE-2026-17052) exists in the time-aware GPIO syscall handler due to missing memory checks.
- Medium severity issues affect the Intel SEDI IPM driver (CVE-2026-17051) and the experimental USB host stack (CVE-2026-17050).
- The vulnerabilities impact core components of the Zephyr RTOS, including GPIO, IPM, and USB subsystems.
On September 21, 2026, a batch of three vulnerabilities was disclosed for the Zephyr Project, a real-time operating system. The vulnerabilities, with severities ranging from Medium to High, were published within a two-hour window, indicating a coordinated disclosure event. These flaws affect core components of the Zephyr RTOS, including its time-aware GPIO driver, Intel SEDI IPM driver, and the experimental USB host stack.
One of the more critical issues, CVE-2026-17052, is a High severity vulnerability in the time-aware GPIO syscall verification handler, z_vrfy_tgpio_pin_read_ts_ec(). This handler failed to perform a K_SYSCALL_MEMORY_WRITE() check on caller-supplied timestamp and event_count output pointers. This oversight could allow for memory corruption or unauthorized memory access by bypassing security validations.
Two Medium severity vulnerabilities were also detailed. CVE-2026-17051 affects the Intel SEDI IPM driver, specifically the ipm_event_dispose() function, which handles inbound message interrupts. The vulnerability lies in how the driver extracts the payload length from an incoming message and passes it directly to sedi_ipc_read_msg() for copying, potentially leading to issues if the length is not properly validated or if the message is malformed.
The third vulnerability, CVE-2026-17050, impacts the experimental USB host stack. In the function usbh_device_set_configuration(), a buffer for configuration descriptors is allocated. However, on certain error paths during the descriptor reading and validation process, the handling of these failures could lead to improper memory management or potential exploits related to the USB device configuration.
The disclosure of these vulnerabilities highlights the importance of thorough security validation, even in specialized components like real-time operating system drivers. Users of the Zephyr Project are advised to review the specific details of each CVE and apply any available patches or mitigations provided by the Zephyr Project maintainers. Further investigation into the potential impact and exploitability of these flaws is recommended.