CVE-2026-55774

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-10681

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-10681: Concurrent Execution using Shared Resource with Improper Synchronization

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...