{"id":"CVE-2026-10682","state":"PUBLISHED","title":"Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace","description":"The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative value for src_id (e.g. -1) trivially satisfied this check and was forwarded into z_impl_log_filter_set, where it propagated to filter_set() and ultimately to get_dynamic_filter(), which uses source_id as an unsigned index into the linker-section array &TYPE_SECTION_START(log_dynamic)[source_id].filters.\n\nAfter implicit conversion through uint32_t, an int16_t -1 becomes 0xFFFFFFFF, indexing log_dynamic far out of bounds and causing the kernel to perform an OOB read and an OOB read-modify-write (LOG_FILTER_SLOT_GET/SET) against memory adjacent to the log_dynamic section.\n\nThe written value is a constrained 3-bit log level slot within the targeted 32-bit word, but the target address is attacker-chosen (a small negative offset from log_dynamic) and the write occurs in supervisor mode following a syscall from an unprivileged user thread, providing a kernel memory-corruption / privilege-escalation primitive.\n\nThe defect is reachable on any build with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y. Present from Zephyr v3.3.0 through v4.4.1. The fix replaces the signed bound check with an unsigned comparison: (uint32_t)src_id < log_src_cnt_get(domain_id), which correctly rejects negative inputs.","publishedAt":"2026-07-27T18:30:49.447Z","updatedAt":"2026-10-15T22:10:20.013Z","severity":{"score":6.6,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","source":"zephyr"},"assigner":"zephyr","products":["zephyrproject zephyr"],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"3.0.0","status":"affected","lessThan":"4.3.1","versionType":"semver"},{"version":"4.4.0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["subsys/logging/log_mgmt.c"]}],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/56a15114c6acbab2067fe406dc3adda8608f3def","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6vqh-mg7h-58qh"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/10xxx/CVE-2026-10682.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-10682","state":"PUBLISHED","datePublished":"2026-07-27T18:30:49.447Z","dateUpdated":"2026-10-15T22:10:20.013Z","assignerShortName":"zephyr","assignerOrgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateReserved":"2026-06-02T15:26:19.350Z"},"containers":{"cna":{"title":"Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace","descriptions":[{"lang":"en","value":"The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative value for src_id (e.g. -1) trivially satisfied this check and was forwarded into z_impl_log_filter_set, where it propagated to filter_set() and ultimately to get_dynamic_filter(), which uses source_id as an unsigned index into the linker-section array &TYPE_SECTION_START(log_dynamic)[source_id].filters.\n\nAfter implicit conversion through uint32_t, an int16_t -1 becomes 0xFFFFFFFF, indexing log_dynamic far out of bounds and causing the kernel to perform an OOB read and an OOB read-modify-write (LOG_FILTER_SLOT_GET/SET) against memory adjacent to the log_dynamic section.\n\nThe written value is a constrained 3-bit log level slot within the targeted 32-bit word, but the target address is attacker-chosen (a small negative offset from log_dynamic) and the write occurs in supervisor mode following a syscall from an unprivileged user thread, providing a kernel memory-corruption / privilege-escalation primitive.\n\nThe defect is reachable on any build with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y. Present from Zephyr v3.3.0 through v4.4.1. The fix replaces the signed bound check with an unsigned comparison: (uint32_t)src_id < log_src_cnt_get(domain_id), which correctly rejects negative inputs."}],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"3.0.0","status":"affected","lessThan":"4.3.1","versionType":"semver"},{"version":"4.4.0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["subsys/logging/log_mgmt.c"]}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/56a15114c6acbab2067fe406dc3adda8608f3def","name":"Fix commit","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6vqh-mg7h-58qh","name":"GHSA-6vqh-mg7h-58qh"}],"metrics":[{"cvssV3_1":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"bounds","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"zephyr","orgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateUpdated":"2026-10-15T22:10:20.013Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-27T19:00:11.037814Z","id":"CVE-2026-10682","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-27T19:00:21.365Z"}}]}}}