Zephyr RTOS: Charger driver API privilege escalation (CVE-2026-91007)
A vulnerability in the Zephyr RTOS charger driver API allows unprivileged user-mode threads to trigger a kernel-mode control-flow hijack due to insufficient syscall verification of function pointers in a union.
CVE search metadata
CVE search record: CVE-2026-91007. Severity: high. CVSS: 7.8. KEV: no. Product: Zephyr RTOS. Brief: Zephyr RTOS: Charger driver API privilege escalation (CVE-2026-91007). Brief link: https://feed.craftedsignal.io/briefs/2026-11-zephyr-charger-syscall-vulnerability-cve-2026-91007/
Triage facts
Revision 1- Applicability
- Zephyr RTOS
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 17:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-91007 involves an improper validation of the charger_propval union within the charger driver API in drivers/charger/charger_handlers.c. User-mode syscall verifiers z_vrfy_charger_set_prop() and z_vrfy_charger_get_prop() failed to inspect the prop argument before copying data across the user/kernel boundary. This allowed user-mode threads to pass arbitrary function pointers for the CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION properties. These pointers are stored in device data by specific drivers (MAX20335, PF1550, and BQ2518x) and subsequently invoked from supervisor-mode interrupt work handlers.
Impact
This vulnerability permits kernel-mode control-flow hijacking from an unprivileged thread, bypassing isolation provided by CONFIG_USERSPACE. Additionally, it facilitates kernel code address disclosure to user memory and allows the suppression of charger notifications.
Recommendation
Apply the patch that updates the syscall verifiers to reject notifier properties and incorporates a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT to ensure future property additions are validated for user-mode safety.