{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3azephyr_projectzephyr_rtos/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zephyr_project:zephyr_rtos:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-91007"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zephyr RTOS"],"_cs_severities":["high"],"_cs_tags":["cve","privilege-escalation","kernel-vulnerability","rtos"],"_cs_type":"advisory","_cs_vendors":["Zephyr Project"],"content_html":"\u003cp\u003eCVE-2026-91007 involves an improper validation of the charger_propval union within the charger driver API in drivers/charger/charger_handlers.c. User-mode syscall verifiers z_vrfy_charger_set_prop() and z_vrfy_charger_get_prop() failed to inspect the prop argument before copying data across the user/kernel boundary. This allowed user-mode threads to pass arbitrary function pointers for the CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION properties. These pointers are stored in device data by specific drivers (MAX20335, PF1550, and BQ2518x) and subsequently invoked from supervisor-mode interrupt work handlers.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability permits kernel-mode control-flow hijacking from an unprivileged thread, bypassing isolation provided by CONFIG_USERSPACE. Additionally, it facilitates kernel code address disclosure to user memory and allows the suppression of charger notifications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eApply the patch that updates the syscall verifiers to reject notifier properties and incorporates a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT to ensure future property additions are validated for user-mode safety.\u003c/p\u003e\n","date_modified":"2026-11-12T17:01:31Z","date_published":"2026-11-12T17:01:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-zephyr-charger-syscall-vulnerability-cve-2026-91007/","summary":"A vulnerability in the Zephyr RTOS charger driver API allows unprivileged user-mode threads to trigger a kernel-mode control-flow hijack due to insufficient syscall verification of function pointers in a union.","title":"Zephyr RTOS: Charger driver API privilege escalation (CVE-2026-91007)","url":"https://feed.craftedsignal.io/briefs/2026-11-zephyr-charger-syscall-vulnerability-cve-2026-91007/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:zephyr_project:zephyr_rtos:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}