CVE-2026-10669: Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validation
On Xtensa SoCs built with CONFIGXTENSAMPU and CONFIGUSERSPACE, archbuffervalidate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return value to 0 (access permitted) and only set a denial result inside its per-MPU-region probe loop. When the rounded extent of the buffer wraps the 32-bit address space (size + alignment offset near SIZEMAX, or ROUNDUP(size + offset) overflowing to 0), the loop executes zero iterations and the function returns 0 = permitted without probing any MPU region.
The syscall-layer pre-checks (KSYSCALLMEMORYSIZECHECK / ZDETECTPOINTEROVERFLOW) only catch a raw addr+size wrap and do not cover the ROUNDUP-induced wrap, and the string path (archuserstringnlen -> archbuffervalidate) has no syscall-layer guard at all.
An unprivileged user-mode thread can therefore pass a crafted (addr, size) to any syscall that validates user buffers via kusermodefromcopy/tocopy or kusermodestringcopy and have validation succeed for memory it must not access; the kernel then reads from (disclosure) or, with write=1, writes to (corruption) attacker-chosen kernel or other-partition memory on the thread's behalf, enabling information disclosure, memory corruption, privilege escalation, and denial of service.
Affected from v3.7.0 (when Xtensa MPU userspace support was added) through v4.4.0. The fix changes the default to -EINVAL (deny by default), adds an explicit sizeaddoverflow check, and sets the success value only after the full range has been validated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Xtensa MPU arch_buffer_validate (arch/xtensa/core/mpu.c)to a version that resolves this vulnerability.Fixed in v4.4.0 - Configuration
In arch/xtensa/core/mpu.c, change arch_buffer_validate() to default to denial-by-default by initializing its return value to -EINVAL (instead of 0) so that permission is not granted unless all MPU region checks succeed.
Xtensa MPU (CONFIG_XTENSA_MPU + CONFIG_USERSPACE) arch_buffer_validate() default return = -EINVAL - Configuration
In arch/xtensa/core/mpu.c, add an explicit size_add_overflow check in arch_buffer_validate() to detect integer overflow when computing/adjusting the requested buffer range before MPU probing.
Xtensa MPU (CONFIG_XTENSA_MPU + CONFIG_USERSPACE) arch_buffer_validate() size_add_overflow check = enabled - Configuration
In arch/xtensa/core/mpu.c, set the success/permit return value only after the full buffer extent has been validated across MPU regions (so returning 0 does not occur when the rounded extent causes the probe loop to execute zero iterations).
Xtensa MPU (CONFIG_XTENSA_MPU + CONFIG_USERSPACE) arch_buffer_validate() success return placement = after full range validated - Compensating control
For Xtensa SoCs with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, apply additional syscall-side guarding for pointer/range validation that covers the ROUND_UP-induced wrap and the string path (arch_user_string_nlen -> arch_buffer_validate), since syscall-layer pre-checks like K_SYSCALL_MEMORY_SIZE_CHECK / Z_DETECT_POINTER_OVERFLOW only catch raw addr+size wrap and the string path has no syscall-layer guard.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10669?
CVE-2026-10669 has a high severity rating of 7.8.
What is the main issue related to CVE-2026-10669?
CVE-2026-10669 involves an integer overflow in `arch_buffer_validate()` that allows a user thread to bypass syscall pointer validation.
How do I fix CVE-2026-10669?
To fix CVE-2026-10669, update your Zephyr Xtensa MPU to a version that addresses the integer overflow in `arch_buffer_validate()`.
Which software is affected by CVE-2026-10669?
CVE-2026-10669 specifically affects the Zephyr Xtensa MPU implementation in the file arch/xtensa/core/mpu.c.
Which systems are vulnerable to CVE-2026-10669?
Systems built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE on Xtensa SoCs are vulnerable to CVE-2026-10669.