CVE-2026-10667

Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated kernel objects. Iteration over this list in k_object_wordlist_foreach() was performed under lists_lock using the SAFE iterator (which caches the next node), but list removal and freeing of nodes was performed under different, disjoint spinlocks: objfree_lock in k_object_free() and obj_lock in unref_check(). On an SMP system, while one CPU iterated obj_list under lists_lock, another CPU could unlink and k_free() the dyn_obj node that the iterator had cached as its next pointer, causing the iterator to dereference freed kernel memory (use-after-free / dangling list traversal). All of the racing operations are reachable from unprivileged user-mode threads via system calls: k_object_alloc/k_object_alloc_size and k_object_release drive removals through unref_check() (under obj_lock), while k_thread_abort and thread creation drive the iteration through k_thread_perms_all_clear()/k_thread_perms_inherit() (under lists_lock). A deprivileged user thread on a CONFIG_SMP + CONFIG_USERSPACE build can therefore corrupt the kernel's object-tracking structures across the userspace security boundary, yielding kernel memory corruption (potential privilege escalation) or a kernel crash (denial of service). The fix removes objfree_lock and serializes every obj_list modification under lists_lock, including holding it across find+remove in k_object_free() and around unref_check() in k_thread_perms_clear(). Affects CONFIG_SMP+CONFIG_USERSPACE+CONFIG_DYNAMIC_OBJECTS configurations; the defect dates to the 2019 spinlockification (commit 8a3d57b6cc6, first released in v1.14.0) and shipped through v4.4.0.

• CWE-416

• https://github.com/zephyrproject-rtos/zephyr/commit/fdc42fa256b8c2a7b27790f032d5385f8058c4a9Patch
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9x5j-h3rh-x579Exploit, Patch, Vendor Advisory
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9x5j-h3rh-x579Exploit, Patch, Vendor Advisory

Published

Jul 12, 2026

Last Modified

Jul 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10661A vulnerability has been found in ahujasid blender-mcp up to…4.3
• CVE-2026-10662A vulnerability was found in ahujasid blender-mcp up to 7636…6.3
• CVE-2026-10663In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STA…6.1
• CVE-2026-10664The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_e…5
• CVE-2026-10665In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), …7.4
• CVE-2026-10666parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipadd…9.8
• CVE-2026-10668The Nuvoton NuMaker HSUSBD USB device-controller driver (dri…4.6
• CVE-2026-10669On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERS…7.8
• CVE-2026-10670The CONFIG_USERSPACE verification handler for the k_thread_n…5.5
• CVE-2026-10671In Zephyr's kernel pipe implementation, the userspace syscal…7.1
• CVE-2026-10672subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmwar…9.1
• CVE-2026-10673The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver …8.3