CVE-2026-90589: zephyrproject zephyr: When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, each thread stack is mapped into the kernel virtual address space with…

When CONFIGTHREADSTACKMEMMAPPED is enabled, each thread stack is mapped into the kernel virtual address space with a guard page on either side, and the mapping is released during abort cleanup. kthreadabortcleanup in kernel/thread.c has two paths: a deferred one for self-abort, which stashes the...

CVE-2026-12631

The Zephyr kernel validates the kthreadjoin and kthreadabort system calls declared syscall in include/zephyr/kernel.h through threadobjvalidate in kernel/thread.c. Its default switch branch is the access-denied path, taken when kobjectvalidate returns -EPERM the calling user thread was never...

CVE-2026-12631 Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel

The Zephyr kernel validates the kthreadjoin and kthreadabort system calls declared syscall in include/zephyr/kernel.h through threadobjvalidate in kernel/thread.c. Its default switch branch is the access-denied path, taken when kobjectvalidate returns -EPERM the calling user thread was never...

CVE-2026-12631: Missing Authorization

The Zephyr kernel validates the kthreadjoin and kthreadabort system calls declared syscall in include/zephyr/kernel.h through threadobjvalidate in kernel/thread.c. Its default switch branch is the access-denied path, taken when kobjectvalidate returns -EPERM the calling user thread was never...