CVE-2026-11743: bounds in zephyrproject zephyr
The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write paths with the test (offset + size) > data->size. Because offset is a signed off_t while size is unsigned, a negative offset is converted to a large unsigned value and the addition can wrap to a small result that passes the check. The read path then performs memcpy(dst, (void *)(data->base + offset), size) and the write path programs flash at offset and cache-invalidates data->base + offset, in both cases accessing memory outside the mapped flash window. The driver's erase path already rejected negative offsets, but read and write did not. In builds with CONFIG_USERSPACE, flash_read and flash_write are syscalls whose verifiers validate the device object and the caller's buffer but deliberately delegate offset bounds checking to the driver. An unprivileged thread that has been granted access to this flash device can therefore call the syscall with a crafted negative offset and a buffer valid in its own memory domain, and reach the unchecked access. The most direct impact is on the read path: by choosing a negative offset and matching size, an attacker slides the memcpy source below the flash base and copies arbitrary CPU-addressable memory into its own buffer, disclosing memory it is not authorized to read. The write path additionally allows programming flash at an out-of-range address and invalidating an attacker-chosen cache range, affecting integrity and availability. Reachability requires userspace to be enabled and the raw flash device object to be granted to an untrusted thread. The fix replaces the check with qspi_nor_range_is_valid(), which rejects negative offsets and performs the bound comparison in overflow-safe 64-bit arithmetic on both paths, and additionally adds an SRAM DMA bounce buffer plus source/destination overlap rejection to prevent a separate DMA bus-hang condition.
AI Analysis
Technical Summary
The SF32LB MPI QSPI NOR flash driver in Zephyr incorrectly validates flash offset and length during read and write operations. The check (offset + size) > data->size is flawed because offset is signed while size is unsigned, allowing negative offsets to convert to large unsigned values and wrap around, passing the check erroneously. This leads to out-of-bounds memory access: the read path can copy arbitrary CPU-addressable memory into the caller's buffer, disclosing unauthorized data, while the write path can program flash at invalid addresses and invalidate attacker-chosen cache ranges, impacting integrity and availability. The erase path correctly rejects negative offsets, but read and write do not. In CONFIG_USERSPACE builds, flash_read and flash_write syscalls delegate offset bounds checking to the driver, enabling unprivileged threads with device access to exploit this. The fix involves replacing the check with qspi_nor_range_is_valid(), which rejects negative offsets and uses overflow-safe 64-bit arithmetic, plus adding an SRAM DMA bounce buffer and overlap rejection to prevent DMA bus hangs.
Potential Impact
An attacker with unprivileged access to the flash device in a userspace-enabled Zephyr build can exploit this vulnerability to read arbitrary memory beyond the flash bounds, disclosing sensitive information. Additionally, the attacker can write to out-of-range flash addresses and invalidate cache ranges, potentially causing integrity and availability issues. The vulnerability requires that the raw flash device object be granted to an untrusted thread and userspace be enabled, limiting the attack surface to such configurations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix replaces the flawed offset and size check with a safe range validation function and adds protections against DMA bus hangs. Until an official patch is available, restrict granting raw flash device access to untrusted userspace threads and consider disabling CONFIG_USERSPACE if feasible to reduce exposure.
CVE-2026-11743: bounds in zephyrproject zephyr
Description
The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write paths with the test (offset + size) > data->size. Because offset is a signed off_t while size is unsigned, a negative offset is converted to a large unsigned value and the addition can wrap to a small result that passes the check. The read path then performs memcpy(dst, (void *)(data->base + offset), size) and the write path programs flash at offset and cache-invalidates data->base + offset, in both cases accessing memory outside the mapped flash window. The driver's erase path already rejected negative offsets, but read and write did not. In builds with CONFIG_USERSPACE, flash_read and flash_write are syscalls whose verifiers validate the device object and the caller's buffer but deliberately delegate offset bounds checking to the driver. An unprivileged thread that has been granted access to this flash device can therefore call the syscall with a crafted negative offset and a buffer valid in its own memory domain, and reach the unchecked access. The most direct impact is on the read path: by choosing a negative offset and matching size, an attacker slides the memcpy source below the flash base and copies arbitrary CPU-addressable memory into its own buffer, disclosing memory it is not authorized to read. The write path additionally allows programming flash at an out-of-range address and invalidating an attacker-chosen cache range, affecting integrity and availability. Reachability requires userspace to be enabled and the raw flash device object to be granted to an untrusted thread. The fix replaces the check with qspi_nor_range_is_valid(), which rejects negative offsets and performs the bound comparison in overflow-safe 64-bit arithmetic on both paths, and additionally adds an SRAM DMA bounce buffer plus source/destination overlap rejection to prevent a separate DMA bus-hang condition.
CVSS v3.1
Score 6.6medium
Affected software
zephyrproject
zephyr
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The SF32LB MPI QSPI NOR flash driver in Zephyr incorrectly validates flash offset and length during read and write operations. The check (offset + size) > data->size is flawed because offset is signed while size is unsigned, allowing negative offsets to convert to large unsigned values and wrap around, passing the check erroneously. This leads to out-of-bounds memory access: the read path can copy arbitrary CPU-addressable memory into the caller's buffer, disclosing unauthorized data, while the write path can program flash at invalid addresses and invalidate attacker-chosen cache ranges, impacting integrity and availability. The erase path correctly rejects negative offsets, but read and write do not. In CONFIG_USERSPACE builds, flash_read and flash_write syscalls delegate offset bounds checking to the driver, enabling unprivileged threads with device access to exploit this. The fix involves replacing the check with qspi_nor_range_is_valid(), which rejects negative offsets and uses overflow-safe 64-bit arithmetic, plus adding an SRAM DMA bounce buffer and overlap rejection to prevent DMA bus hangs.
Potential Impact
An attacker with unprivileged access to the flash device in a userspace-enabled Zephyr build can exploit this vulnerability to read arbitrary memory beyond the flash bounds, disclosing sensitive information. Additionally, the attacker can write to out-of-range flash addresses and invalidate cache ranges, potentially causing integrity and availability issues. The vulnerability requires that the raw flash device object be granted to an untrusted thread and userspace be enabled, limiting the attack surface to such configurations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix replaces the flawed offset and size check with a safe range validation function and adds protections against DMA bus hangs. Until an official patch is available, restrict granting raw flash device access to untrusted userspace threads and consider disabling CONFIG_USERSPACE if feasible to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-09T05:26:14.980Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a764da6bf8831d5392fda8a
Added to database: 08/07/2026, 21:27:02 UTC
Last enriched: 08/15/2026, 15:13:30 UTC
Last updated: 09/22/2026, 01:52:41 UTC
Views: 114
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.