CVE-2026-19676: memory-safety in zephyrproject zephyr

The vulnerability exists in the user-mode verifier function z_vrfy_peci_transfer() in Zephyr's PECI driver subsystem. While the outer peci_msg structure is validated, the embedded tx_buffer and rx_buffer pointers and their lengths are not checked, allowing a user-mode thread with PECI device access to supply pointers to arbitrary kernel memory. The PECI drivers dereference these pointers in supervisor mode to read and write hardware bytes, enabling an arbitrary kernel read/write primitive. This leads to a full user-mode-to-kernel privilege escalation, including potential code execution at supervisor level. Exploitation requires CONFIG_USERSPACE=y, one of the PECI drivers enabled (CONFIG_PECI_NPCX, CONFIG_PECI_XEC, or CONFIG_PECI_ITE_IT8XXX2), and local user-mode code holding the PECI device object. The fix introduces K_SYSCALL_MEMORY_READ() and K_SYSCALL_MEMORY_WRITE() checks on the embedded buffers with overflow guards to prevent this attack.

Successful exploitation allows an attacker with local user-mode access and PECI device permissions to perform arbitrary kernel memory reads and writes, resulting in full kernel privilege escalation. This compromises system integrity and confidentiality, enabling code execution at supervisor privilege. Additionally, kernel memory contents can be disclosed to an observer on the PECI bus. The vulnerability also can cause supervisor-mode faults if invalid addresses are supplied.

A fix is available that adds proper memory access validation for the embedded buffers in the peci_msg structure, preventing arbitrary kernel memory access. Users should upgrade Zephyr to versions later than 4.4.2 where this patch is applied. Until patched, ensure that user-mode threads do not hold PECI device permissions unless necessary and disable affected PECI drivers if possible. Monitor vendor advisories for official patches and apply them promptly.