CVE-2026-12235: bounds in zephyrproject zephyr
The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and then performed the relocation write there without validating rela.r_offset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llext_file_offset(). rela.r_offset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via r_offset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs. The path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial. The fix adds a bound check rejecting any RELA entry whose r_offset >= tgt->sh_size, mirroring the existing validation in the shared branch.
AI Analysis
Technical Summary
The llext subsystem in Zephyr mis-handles PLT/RELA relocation entries during linking of relocatable ELF extensions on Xtensa. Specifically, in llext_link_plt(), the relocation offset (rela.r_offset) is used without validation, allowing crafted ELF files to cause out-of-bounds writes outside the extension's text buffer. This occurs before any extension code runs and in supervisor context, leading to memory corruption and potential sandbox escape. The vulnerability is gated by the Xtensa relocatable PLT path and writable storage requirements. The fix adds a bounds check rejecting any RELA entry with r_offset greater than or equal to the target section size, mirroring existing validation in other code paths.
Potential Impact
An attacker supplying a malicious ELF extension on Xtensa with writable storage can trigger an out-of-bounds write in supervisor context during linking. This results in memory corruption affecting integrity and availability, and can break sandbox boundaries for user-mode extensions. Exploitation requires specific conditions and is non-trivial, but the impact includes potential privilege escalation and system instability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix adds bounds checking on relocation offsets to prevent out-of-bounds writes. Until an official fix is applied, avoid loading untrusted relocatable ELF extensions on Xtensa architectures with writable storage to mitigate risk.
CVE-2026-12235: bounds in zephyrproject zephyr
Description
The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and then performed the relocation write there without validating rela.r_offset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llext_file_offset(). rela.r_offset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via r_offset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs. The path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial. The fix adds a bound check rejecting any RELA entry whose r_offset >= tgt->sh_size, mirroring the existing validation in the shared branch.
CVSS v3.1
Score 6.3medium
Affected software
zephyrproject
zephyr
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The llext subsystem in Zephyr mis-handles PLT/RELA relocation entries during linking of relocatable ELF extensions on Xtensa. Specifically, in llext_link_plt(), the relocation offset (rela.r_offset) is used without validation, allowing crafted ELF files to cause out-of-bounds writes outside the extension's text buffer. This occurs before any extension code runs and in supervisor context, leading to memory corruption and potential sandbox escape. The vulnerability is gated by the Xtensa relocatable PLT path and writable storage requirements. The fix adds a bounds check rejecting any RELA entry with r_offset greater than or equal to the target section size, mirroring existing validation in other code paths.
Potential Impact
An attacker supplying a malicious ELF extension on Xtensa with writable storage can trigger an out-of-bounds write in supervisor context during linking. This results in memory corruption affecting integrity and availability, and can break sandbox boundaries for user-mode extensions. Exploitation requires specific conditions and is non-trivial, but the impact includes potential privilege escalation and system instability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix adds bounds checking on relocation offsets to prevent out-of-bounds writes. Until an official fix is applied, avoid loading untrusted relocatable ELF extensions on Xtensa architectures with writable storage to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-15T01:56:05.689Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7c6c5abf8831d5398f6fb6
Added to database: 08/12/2026, 12:51:38 UTC
Last enriched: 08/12/2026, 12:52:53 UTC
Last updated: 09/26/2026, 13:47:42 UTC
Views: 71
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.