CVE-2026-19669: memory-safety in zephyrproject zephyr

The vulnerability exists in the user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in Zephyr's fuel gauge driver. These functions declare variable-length arrays sized directly by an unvalidated length parameter from the syscall ABI, allocated before any permission checks. The kernel copies attacker-controlled data into these arrays without proper bounds checking, leading to an out-of-bounds write on the supervisor stack. This can cause a sandbox escape from user mode to kernel mode, enabling kernel code execution or system crashes. The default privileged stack size is 1024 bytes, and a length of about 170 can exhaust it. The fix involves removing kernel-side copies and validating user arrays in place with K_SYSCALL_MEMORY_ARRAY_READ()/WRITE(), preventing length overflow and ensuring safety.

An attacker running in user mode with CONFIG_USERSPACE enabled and access to a fuel gauge device object can exploit this vulnerability to perform out-of-bounds writes in kernel memory. This can lead to privilege escalation by breaking out of the user-mode sandbox, resulting in kernel code execution or system crashes. The vulnerability affects system confidentiality, integrity, and availability.

A fix is available that removes unsafe kernel-side copies and validates user-supplied arrays safely using K_SYSCALL_MEMORY_ARRAY_READ() and K_SYSCALL_MEMORY_ARRAY_WRITE(). Users should upgrade to Zephyr version 4.5.0 or later where this vulnerability is addressed. Until then, restricting user-mode access to fuel gauge device objects can reduce risk. Patch status is confirmed by the vendor advisory.