{"id":"CVE-2026-10682","title":"Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace","summary":"The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative val…","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"zephyrproject","product":"zephyr","affected":["zephyr >= 3.0.0 < 4.3.1","zephyr >= 4.4.0 < 4.4.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-27T19:00:11.037814Z"},"published":"2026-07-27","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:10:20.013Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-10682","references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/56a15114c6acbab2067fe406dc3adda8608f3def","label":"Fix commit"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6vqh-mg7h-58qh","label":"GHSA-6vqh-mg7h-58qh"}],"tags":["cve.org"],"epss":0.00169,"epssPercentile":0.0577,"ingestedAt":"2026-10-15T22:48:25.571Z","slug":"CVE-2026-10682","body":"## Overview\n\nThe userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative value for src_id (e.g. -1) trivially satisfied this check and was forwarded into z_impl_log_filter_set, where it propagated to filter_set() and ultimately to get_dynamic_filter(), which uses source_id as an unsigned index into the linker-section array &TYPE_SECTION_START(log_dynamic)[source_id].filters.\n\nAfter implicit conversion through uint32_t, an int16_t -1 becomes 0xFFFFFFFF, indexing log_dynamic far out of bounds and causing the kernel to perform an OOB read and an OOB read-modify-write (LOG_FILTER_SLOT_GET/SET) against memory adjacent to the log_dynamic section.\n\nThe written value is a constrained 3-bit log level slot within the targeted 32-bit word, but the target address is attacker-chosen (a small negative offset from log_dynamic) and the write occurs in supervisor mode following a syscall from an unprivileged user thread, providing a kernel memory-corruption / privilege-escalation primitive.\n\nThe defect is reachable on any build with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y. Present from Zephyr v3.3.0 through v4.4.1. The fix replaces the signed bound check with an unsigned comparison: (uint32_t)src_id < log_src_cnt_get(domain_id), which correctly rejects negative inputs.\n\n## Affected\n\n- `zephyr >= 3.0.0 < 4.3.1`\n- `zephyr >= 4.4.0 < 4.4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":36.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}