Cpe:2.3:a:zephyr_project:zephyr_rtos:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3azephyr_projectzephyr_rtos/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 17:01:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgZephyr RTOS: Charger driver API privilege escalation (CVE-2026-91007)https://feed.craftedsignal.io/briefs/2026-11-zephyr-charger-syscall-vulnerability-cve-2026-91007/Thu, 12 Nov 2026 17:01:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-zephyr-charger-syscall-vulnerability-cve-2026-91007/A vulnerability in the Zephyr RTOS charger driver API allows unprivileged user-mode threads to trigger a kernel-mode control-flow hijack due to insufficient syscall verification of function pointers in a union.CVE-2026-91007 involves an improper validation of the charger_propval union within the charger driver API in drivers/charger/charger_handlers.c. User-mode syscall verifiers z_vrfy_charger_set_prop() and z_vrfy_charger_get_prop() failed to inspect the prop argument before copying data across the user/kernel boundary. This allowed user-mode threads to pass arbitrary function pointers for the CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION properties. These pointers are stored in device data by specific drivers (MAX20335, PF1550, and BQ2518x) and subsequently invoked from supervisor-mode interrupt work handlers.

Impact

This vulnerability permits kernel-mode control-flow hijacking from an unprivileged thread, bypassing isolation provided by CONFIG_USERSPACE. Additionally, it facilitates kernel code address disclosure to user memory and allows the suppression of charger notifications.

Recommendation

Apply the patch that updates the syscall verifiers to reject notifier properties and incorporates a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT to ensure future property additions are validated for user-mode safety.

]]>highadvisorycveprivilege-escalationkernel-vulnerabilityrtos