AIKIDO-2026-274054
zephyrproject-rtos.zephyr is vulnerable to Out-of-Bounds Write
63
Medium Risk
This Affects:
zephyrproject-rtos.zephyrTL;DR
On Xtensa, the LLEXT PLT relocatable link path in llext_link_plt() applies RELA entries at section_base + r_offset without checking that r_offset stays within the target section. A crafted extension ELF can therefore cause a privileged out-of-bounds write during load/link, before extension code runs, corrupting kernel memory or crashing the device. The shared/dynamic PLT branch already validated offsets; the fix adds the same style of bounds check to the relocatable branch and skips out-of-range entries.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you build for Xtensa with CONFIG_LLEXT enabled and load relocatable extension binaries from an untrusted or externally influenced source.
Background info
zephyrproject-rtos.zephyr is vulnerable to Out-of-Bounds Write in versions 3.7.0 - 4.4.1.
How to fix this
Upgrade the zephyrproject-rtos.zephyr library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant