PT-2026-128334

The GPIO syscall handlers in drivers/gpio/gpio handlers.c did not validate the pin argument supplied by a user-mode caller. z vrfy gpio pin configure, z vrfy gpio pin get config and z vrfy gpio pin interrupt configure verified only the device object K SYSCALL DRIVER GPIO / K SYSCALL OBJ and then...

PT-2026-122213

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate tlb page in arch/arm64/core/mmu.c, which issued TLBI VAE1IS with an operand of virt 12. That operand encodes the ASID in bits 63:48, so the invalidation only ever matched ASID 0 the kernel page tables and glob...

PT-2026-120774

The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux select get and devmux select set. When CONFIG USERSPACE is enabled, their user-mode verifiers z vrfy devmux select get and z vrfy devmux select set forwarded directly to the kernel implementation...

PT-2026-117695

Name of the Vulnerable Software and Affected Versions Zephyr OS affected versions not specified Description An issue exists in the user-mode syscall verifier z vrfy rtio cqe get mempool buffer within subsys/rtio/rtio syscalls.c. The verifier incorrectly uses K SYSCALL MEMORY READ instead of K...

PT-2026-108759

The user-mode verification handler for the device deinit system call, z vrfy device deinit in kernel/device.c, validated its dev argument with K SYSCALL OBJ INITdev, K OBJ ANY. k object validate short-circuits its type comparison when the requested type is K OBJ ANY, so the check reduced to "this...

PT-2026-108755

dynamic object create in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj size getotype + size, and for thread stack elements as STACK ELEMENT DATA SIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

PT-2026-104750

The system-call verifier for i3c do ccc in drivers/i3c/i3c handlers.c validated the outer struct i3c ccc payload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3c ccc target payload carrie...

PT-2026-102351

Name of the Vulnerable Software and Affected Versions RTIO versions prior to 4.3.0 Description The userspace verifier function z vrfy rtio sqe copy in get handles in subsys/rtio/rtio syscalls.c and subsys/rtio/rtio handlers.c in earlier versions fails to validate the handle out-parameter. This...

PT-2026-72078

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description A use-after-free issue exists in the dynamic kernel-object disposal path unref check within kernel/userspace/userspace.c. The system frees an object's storage using k freedyn-data when its...

PT-2026-58037

Name of the Vulnerable Software and Affected Versions Zephyr versions 2.0.0 through 4.4.0 Description In builds with CONFIG USERSPACE and CONFIG THREAD NAME enabled, the z vrfy k thread name copy function in kernel/thread.c for the k thread name copy system call fails to properly validate the...