6 matches found
CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap
dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...
CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap
dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...
CVE-2026-19569
An integer overflow vulnerability exists in the Zephyr RTOS kernel's dynamic_object_create() function within kernel/userspace/userspace.c. The system fails to check for unsigned wrap-around when computing backing allocations for dynamically allocated kernel objects and thread stack elements. An u...
EUVD-2026-95529
dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...
CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap
dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...
CVE-2026-19569: Integer Overflow or Wraparound
dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...