CVE-2026-19676

The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the outer structure only; the buf pointers and len values inside the embedded struct peci_buf members tx_buffer and rx_buffer remained fully caller-controlled and were passed unchecked to the driver. Every in-tree PECI driver dereferences those pointers in supervisor mode: peci_npcx_transfer() in drivers/peci/peci_npcx.c and peci_it8xxx2_transfer() in drivers/peci/peci_ite_it8xxx2.c copy hardware bytes into rx_buffer.buf[i] and read command bytes out of tx_buffer.buf[i], and peci_xec_read()/peci_xec_write() in drivers/peci/peci_mchp_xec.c do the same with no bound on rx_buffer.len at all. A user-mode thread that has been granted the PECI device object — the normal way an application exposes a device under CONFIG_USERSPACE — could therefore point rx_buffer.buf at kernel data structures and have the driver write hardware-supplied bytes there, or point tx_buffer.buf at kernel memory and have its contents pushed onto the PECI/eSPI out-of-band bus. The impact is a full user-mode-to-kernel escape: an arbitrary kernel write primitive (integrity and, through it, code execution at supervisor privilege), an arbitrary kernel read disclosed to a PECI bus observer, and a trivially reachable supervisor-mode fault if an unmapped address is supplied. Exploitation requires CONFIG_USERSPACE=y, one of the PECI drivers enabled (CONFIG_PECI_NPCX, CONFIG_PECI_XEC or CONFIG_PECI_ITE_IT8XXX2), and local code execution in a user-mode thread holding the PECI device. The fix adds K_SYSCALL_MEMORY_READ() and K_SYSCALL_MEMORY_WRITE() checks over the two embedded buffers, with a size_add_overflow() guard on the frame-check-sequence byte accounted for in the RX length.

• CWE-822

• https://github.com/zephyrproject-rtos/zephyr/commit/d7faf323d52b7e8845a63b1f854a82bdda44c261
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-g66q-frxm-3hfg

Published

Oct 21, 2026

Last Modified

Oct 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19668A BIND recursive resolver may experience excessive resource …5.3
• CVE-2026-19669The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props(…7.8
• CVE-2026-19670Malcolm's nginx Lua role-based access control (RBAC) layer d…5.4
• CVE-2026-19671Malcolm's upload-processing pipeline (scripts/safe-extract.p…6.5
• CVE-2026-19672The tarfile module's tar and data extraction filters create…6.3
• CVE-2026-19673ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validat…7.1
• CVE-2026-19677An authentication bypass vulnerability in the public onPhase…9.3
• CVE-2026-19678A server-side request forgery (SSRF) vulnerability in the un…8.7
• CVE-2026-19679An input validation vulnerability exists in Security Center'…8.8
• CVE-2026-19680A SQL injection vulnerability exists in Security Center that…7.1
• CVE-2026-19681An authenticated command injection vulnerability exists in S…9.9
• CVE-2026-19682A command injection vulnerability exists in Security Center …9.9