---
id: CVE-2026-12235
title: >-
  Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF
  (CWE-787)
summary: >-
  The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA
  relocation entries when linking a relocatable (partially-linked) ELF
  extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable
  branch (tgt != NULL,…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: zephyrproject
product: zephyr
affected:
  - zephyr >= 3.7.0 < 4.3.2
  - zephyr >= 4.4.0 < 4.4.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-12T12:34:31.991332Z'
exploitAvailable: true
published: '2026-08-12'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T04:59:20.913Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-12235'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/106540afbd22087ad40b90f53fb22657754a719e
    label: Fix commit
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xv9q-6mrf-8j49
    label: GHSA-xv9q-6mrf-8j49
tags:
  - cve.org
  - exploit-available
epss: 0.00137
epssPercentile: 0.03141
ingestedAt: '2026-11-05T20:33:06.698Z'
---

## Overview

The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and then performed the relocation write there without validating rela.r_offset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llext_file_offset().

rela.r_offset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via r_offset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs.

The path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial.

The fix adds a bound check rejecting any RELA entry whose r_offset >= tgt->sh_size, mirroring the existing validation in the shared branch.

## Affected

- `zephyr >= 3.7.0 < 4.3.2`
- `zephyr >= 4.4.0 < 4.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.