---
id: CVE-2026-10677
title: >-
  Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread
  exhaust the kernel resource pool
summary: >-
  The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c
  allocates a kernel-side copy of the user-supplied k_poll_event[] via
  z_thread_malloc() and then validates each event's object handle. Before this
  fix, validation used…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-401
vendor: zephyrproject
product: zephyr
affected:
  - zephyr >= 1.12.0 < 4.3.1
  - zephyr >= 4.4.0 < 4.4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-22T19:32:15.826317Z'
published: '2026-07-21'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:10:17.547Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-10677'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/8dc7a37bc75402a0a3329397887f32f5fb4da3ad
    label: Fix commit
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r3cc-8wcr-xfj9
    label: GHSA-r3cc-8wcr-xfj9
tags:
  - cve.org
epss: 0.00143
epssPercentile: 0.03185
ingestedAt: '2026-10-15T22:48:25.570Z'
---

## Overview

The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy.

A user thread can pass num_events >= 1 with a forged object handle to leak the allocation; because newly spawned user threads inherit the parent's resource_pool (kernel/thread.c), an attacker spawns sacrificial threads to repeat the leak until the shared kernel heap is exhausted. Once depleted, legitimate kernel allocations from that pool (k_queue alloc nodes, k_msgq buffers, future k_poll calls, etc.) fail, causing a system-level denial of service.

The fix replaces each inline K_OOPS with a conditional goto oops_free so the buffer is freed before the thread is killed. Affects Zephyr releases from v1.12.0 (when k_poll was first exposed to user mode) through v4.4.1.

## Affected

- `zephyr >= 1.12.0 < 4.3.1`
- `zephyr >= 4.4.0 < 4.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.