{"id":"CVE-2026-19676","kind":"vulnerability","aliases":["CVE-2026-19676"],"related":[],"title":"Zephyr: PECI syscall lets user threads write kernel memory","description":"The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the outer structure only; the buf pointers and len values inside the embedded struct peci_buf members tx_buffer and rx_buffer remained fully caller-controlled and were passed unchecked to the driver.\n\nEvery in-tree PECI driver dereferences those pointers in supervisor mode: peci_npcx_transfer() in drivers/peci/peci_npcx.c and peci_it8xxx2_transfer() in drivers/peci/peci_ite_it8xxx2.c copy hardware bytes into rx_buffer.buf[i] and read command bytes out of tx_buffer.buf[i], and peci_xec_read()/peci_xec_write() in drivers/peci/peci_mchp_xec.c do the same with no bound on rx_buffer.len at all. A user-mode thread that has been granted the PECI device object — the normal way an application exposes a device under CONFIG_USERSPACE — could therefore point rx_buffer.buf at kernel data structures and have the driver write hardware-supplied bytes there, or point tx_buffer.buf at kernel memory and have its contents pushed onto the PECI/eSPI out-of-band bus.\n\nThe impact is a full user-mode-to-kernel escape: an arbitrary kernel write primitive (integrity and, through it, code execution at supervisor privilege), an arbitrary kernel read disclosed to a PECI bus observer, and a trivially reachable supervisor-mode fault if an unmapped address is supplied. Exploitation requires CONFIG_USERSPACE=y, one of the PECI drivers enabled (CONFIG_PECI_NPCX, CONFIG_PECI_XEC or CONFIG_PECI_ITE_IT8XXX2), and local code execution in a user-mode thread holding the PECI device.\n\nThe fix adds K_SYSCALL_MEMORY_READ() and K_SYSCALL_MEMORY_WRITE() checks over the two embedded buffers, with a size_add_overflow() guard on the frame-check-sequence byte accounted for in the RX length.","summary":"The PECI transfer system call in Zephyr does not check the buffer pointers and lengths inside its message struct, so a user-mode thread holding the PECI device can point them at kernel memory. An attacker can write hardware-supplied bytes into kernel memory for code execution at supervisor privilege, or read kernel data out over the PECI bus.","severity":"high","cvss":7.8,"epss":0.00114,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","peci","runtime","userspace","zephyr"],"not_affected_if":["no-peci-driver","no-user-threads-with-peci-access","no-userspace"],"how_to_check":"- Check whether the build sets `CONFIG_USERSPACE=y` and enables one of `CONFIG_PECI_NPCX`, `CONFIG_PECI_XEC` or `CONFIG_PECI_ITE_IT8XXX2`\n- Check the Zephyr version in the tree with `git describe --tags` and compare it with the fixed release in the advisory (unknown in sources)","fix":"- Update Zephyr to a release containing the fix that adds `K_SYSCALL_MEMORY_READ()` and `K_SYSCALL_MEMORY_WRITE()` checks in `drivers/peci/peci_handlers.c` (fixed version: unknown in sources)\n- Until updated, avoid granting user threads the PECI device object or disable `CONFIG_USERSPACE` for affected builds","status":"open","published_at":"2026-10-21T19:17:02+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:08:16+00:00","updated_at":"2026-10-25T03:08:16+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:08:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update Zephyr to a release containing the fix that adds `K_SYSCALL_MEMORY_READ()` and `K_SYSCALL_MEMORY_WRITE()` checks in `drivers/peci/peci_handlers.c` (fixed version: unknown in sources)\n- Until updated, avoid granting user threads the PECI device object or disable `CONFIG_USERSPACE` for affected builds","reach":"local","title":"Zephyr: PECI syscall lets user threads write kernel memory","impact":"high","summary":"The PECI transfer system call in Zephyr does not check the buffer pointers and lengths inside its message struct, so a user-mode thread holding the PECI device can point them at kernel memory. An attacker can write hardware-supplied bytes into kernel memory for code execution at supervisor privilege, or read kernel data out over the PECI bus.","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","peci","userspace"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker writes kernel memory and gains supervisor code execution","analyst_note":"Confirm the fixed Zephyr release and the affected version range from the NVD entry and the Zephyr security advisory; the sources give neither.","how_to_check":"- Check whether the build sets `CONFIG_USERSPACE=y` and enables one of `CONFIG_PECI_NPCX`, `CONFIG_PECI_XEC` or `CONFIG_PECI_ITE_IT8XXX2`\n- Check the Zephyr version in the tree with `git describe --tags` and compare it with the fixed release in the advisory (unknown in sources)","needs_analyst":true,"not_affected_if":["no-userspace","no-peci-driver","no-user-threads-with-peci-access"],"who_is_affected":"Zephyr applications that run user-mode threads (CONFIG_USERSPACE) and that grant those threads access to a PECI device using one of the in-tree PECI drivers for NPCX, XEC or IT8XXX2 hardware. Systems without userspace or without these PECI drivers do not have this exposure, and single-privilege firmware with no user threads can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000804,"input_tokens":4052,"output_tokens":797,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-19676':12A,15A '-2026':11A,14A '/peci_xec_write':197C 'account':387C 'add':358C,377C 'address':317C 'applic':227C 'arbitrari':283C,297C 'attack':57B 'band':269C 'bound':205C 'buf':127C,137C 'buffer':32B,140C,143C,373C 'bus':81B,270C,304C 'byte':63B,181C,188C,250C,386C 'call':25B,92C 'caller':109C,147C 'caller-control':146C 'caller-suppli':108C 'check':30B,99C,368C,384C 'code':68B,291C,344C 'command':187C 'config':232C,322C,331C,334C,338C 'content':261C 'control':148C 'copi':106C,118C,120C,179C 'could':234C 'cve':10A,13A 'data':76B,240C 'derefer':162C 'devic':49B,102C,221C,230C,355C 'disclos':300C 'driver':155C,161C,245C,329C 'drivers/peci/peci_handlers.c':98C 'drivers/peci/peci_ite_it8xxx2.c':178C 'drivers/peci/peci_mchp_xec.c':199C 'drivers/peci/peci_npcx.c':172C 'embed':16B,134C,372C 'enabl':330C 'escap':281C 'everi':156C 'execut':69B,292C,345C 'exploit':320C 'expos':228C 'fault':313C 'fix':357C 'frame':383C 'frame-check-sequ':382C 'full':275C 'fulli':145C 'grant':218C 'guard':379C 'hardwar':61B,180C,248C 'hardware-suppli':60B,247C 'hold':46B,352C 'impact':272C 'in-tre':157C 'insid':36B,132C 'integr':287C 'it8xxx2':175C,341C 'ite':340C 'k':115C,359C,364C 'kernel':8A,54B,65B,75B,239C,256C,280C,284C,298C 'len':130C 'length':35B,392C 'let':4A 'local':343C 'member':138C 'memori':9A,55B,66B,257C,361C,366C 'messag':38B 'mode':44B,85C,167C,213C,278C,312C,350C 'msg':113C 'normal':224C 'npcx':169C,333C 'object':103C,222C 'observ':305C 'one':325C 'onto':263C 'out-of-band':266C 'outer':123C 'overflow':378C 'pass':151C 'peci':2A,17B,22B,48B,80B,89C,95C,112C,136C,160C,168C,174C,194C,220C,303C,328C,332C,335C,339C,354C 'peci/espi':265C 'permiss':104C 'point':51B,236C,253C 'pointer':33B,128C,164C 'primit':286C 'privileg':72B,295C 'push':262C 'reachabl':309C 'read':74B,186C,196C,299C,362C 'remain':144C 'requir':321C 'runtim':18B 'rx':142C,391C 'rx_buffer.buf':183C,237C 'rx_buffer.len':207C 'sequenc':385C 'size':376C 'struct':39B,111C,135C 'structur':124C,241C 'supervisor':71B,166C,294C,311C 'supervisor-mod':310C 'suppli':62B,110C,249C,319C 'syscal':3A,360C,365C 'system':24B,91C 'therefor':235C 'thread':6A,45B,214C,351C 'transfer':23B,90C,96C,170C,176C 'tree':159C 'trivial':308C 'two':371C 'tx':139C 'tx_buffer.buf':191C,254C 'uncheck':152C 'unmap':316C 'user':5A,43B,84C,212C,277C,349C 'user-mod':42B,83C,211C,348C 'user-mode-to-kernel':276C 'usermod':116C 'userspac':19B,233C,323C 'valid':121C 'valu':131C 'verifi':86C 'vrfi':94C 'way':225C 'write':7A,59B,246C,285C,367C 'xec':195C,336C 'y':324C 'z':93C 'zephyr':1A,20B,27B","nicknames":[],"mitigations":[],"who_affected":"Zephyr applications that run user-mode threads (CONFIG_USERSPACE) and that grant those threads access to a PECI device using one of the in-tree PECI drivers for NPCX, XEC or IT8XXX2 hardware. Systems without userspace or without these PECI drivers do not have this exposure, and single-privilege firmware with no user threads can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19676","severity":null,"published_at":"2026-10-21T19:17:02+00:00","modified_at":"2026-10-23T22:16:59+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-19676","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19676","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}