CVE-2026-12235: Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)
The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llextlinkplt() (subsys/llext/llextlink.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXTMEMTEXT] - text.shoffset + rela.roffset + tgt->shoffset and then performed the relocation write there without validating rela.roffset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llextfileoffset().
rela.roffset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via roffset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs.
The path is reached from llextload() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial.
The fix adds a bound check rejecting any RELA entry whose roffset >= tgt->shsize, mirroring the existing validation in the shared branch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In llext_link_plt() (subsys/llext/llext_link.c) for the Xtensa relocatable PLT path (tgt != NULL), add a bound check and reject relocation entries when rela.r_offset (r_offset) is >= tgt->sh_size, mirroring the existing out-of-range validation done in the sibling shared/dynamic branch via llext_file_offset().
llext (Xtensa) RELA relocation r_offset bounds validation in llext_link_plt() = reject any RELA entry with r_offset >= tgt->sh_size
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12235?
CVE-2026-12235 has a severity rating of medium with a score of 6.3.
How do I fix CVE-2026-12235?
To address CVE-2026-12235, update the Xtensa llext software to the latest version where the vulnerability is patched.
What kind of vulnerability is CVE-2026-12235?
CVE-2026-12235 is an out-of-bounds write vulnerability that occurs during PLT relocation in malformed ELF files.
Which software is affected by CVE-2026-12235?
CVE-2026-12235 affects the Xtensa llext subsystem.
What are the potential impacts of CVE-2026-12235?
The potential impacts of CVE-2026-12235 include possible arbitrary code execution and system instability due to out-of-bounds writes.