Skip to content
Heist/ feed
Medium

SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

Type: advisorySource: Official CVE List1 source record

The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smbus/smbus_handlers.c validated only the dev argument with K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS) and forwarded the caller-supplied struct smbus_callback *cb pointer into kernel-mode driver code without any K_SYSCALL_MEMORY_READ/K_SYSCALL_MEMORY_WRITE validation. A companion change in 2023 had already removed the matching smbus_smbalert_set_cb() / smbus_host_notify_set_cb() syscalls for this reason, but the two removal syscalls were left exposed. On a build with CONFIG_USERSPACE=y, CONFIG_SMBUS=y and a driver implementing the callback operations (drivers/smbus/intel_pch_smbus.c with CONFIG_SMBUS_INTEL_PCH_SMBALERT/CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or drivers/smbus/smbus_stm32.c with CONFIG_SMBUS_STM32_SMBALERT), any user-mode thread that has been granted the SMBus device object can invoke these syscalls with an arbitrary pointer. The value reaches smbus_callback_remove() in drivers/smbus/smbus_utils.h, which uses it as a node identity against the kernel's sys_slist_t of registered callbacks. The consequence is that an unprivileged thread can unregister an SMBALERT or Host Notify callback that a supervisor-mode component registered, silently disabling alert handling for the rest of the system; because Zephyr images have fixed symbol addresses and the syscall returns 0 on a hit versus -ENOENT on a miss, the target address is both derivable

Announced Source revision 1
Original source ↗

CVE-2026-17053

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-17053

zephyr

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "zephyrproject",
    "product": "zephyr",
    "versions": [
      {
        "status": "affected",
        "version": "3.4.0",
        "lessThan": "4.4.2",
        "versionType": "semver"
      }
    ],
    "packageName": "zephyr",
    "programFiles": [
      "drivers/smbus/smbus_handlers.c",
      "include/zephyr/drivers/smbus.h"
    ],
    "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "smbus_callback_remove"
      },
      {
        "name": "z_impl_smbus_host_notify_remove_cb"
      },
      {
        "name": "z_impl_smbus_smbalert_remove_cb"
      },
      {
        "name": "z_vrfy_smbus_host_notify_remove_cb"
      },
      {
        "name": "z_vrfy_smbus_smbalert_remove_cb"
      }
    ]
  }
]
Related CVEs
CVE-2026-17053

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#5675 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement