CVE-2026-91007

The Zephyr RTOS charger driver API contains a vulnerability where user-mode syscall verifiers in drivers/charger/charger_handlers.c failed to inspect the prop argument. This allowed the charger_set_prop() syscall to copy a union containing function pointers—specifically status_notification and on...