Zephyr RTOS: High and Medium Severity Flaws in Kernel, Settings, and Flash Drivers Disclosed Together
Three vulnerabilities, including one High and two Medium severity, were disclosed in the Zephyr RTOS between August 17-19, 2026, affecting kernel, settings, and flash driver components.
Key findings
- High-severity CVE-2026-9771 impacts flash_copy() system call in userspace-enabled builds.
- Medium-severity CVE-2026-12631 involves improper validation in Zephyr kernel thread management.
- Medium-severity CVE-2026-12634 is a buffer overflow in the settings subsystem's NVS backend.
- All three vulnerabilities were disclosed between August 17-19, 2026.
- No known exploitation in the wild reported for this batch.
The Zephyr Project, an open-source real-time operating system for embedded devices, is addressing three vulnerabilities disclosed between August 17 and August 19, 2026. The disclosures, which span two days, highlight potential weaknesses in the OS's settings subsystem, kernel, and flash drivers. While no exploitation in the wild has been reported for these specific CVEs, their presence underscores the continuous need for security vigilance in embedded systems.
One of the disclosed vulnerabilities, CVE-2026-9771, is rated High with a CVSSv3 score of 8.8. This flaw resides in the flash_copy() system call within the drivers/flash/flash_util.c file. When CONFIG_USERSPACE is enabled, this function acts as a kernel-side trust boundary for user-mode callers. However, prior to the fix, it only validated the output buffer (K_SYSCALL_MEMORY_WRITE) and incorrectly passed two struct device pointers, potentially allowing unauthorized memory access or manipulation.
Two Medium-severity vulnerabilities were also disclosed. CVE-2026-12631, with a CVSSv3 score of 6.5, affects the Zephyr kernel's thread management. The k_thread_join() and k_thread_abort() system calls are validated through thread_obj_validate() in kernel/thread.c. The default switch branch in this validation was the access-denied path, which was incorrectly taken when the calling user thread had not been granted the necessary permissions, potentially leading to unintended thread state changes or denial-of-service conditions.
The third vulnerability, CVE-2026-12634 (CVSSv3 5.3), is located in the NVS backend of the Zephyr settings subsystem at subsys/settings/src/settings_nvs.c. This issue arises from the fixed 74-byte stack buffers used to read stored setting-name entries. The code attempts to NUL-terminate these buffers with bufrc = '\0', where 'rc' is the return value of nvs_read(). However, nvs_read() can return the full stored entry length, which may exceed the buffer size, leading to a buffer overflow when writing the null terminator.
These vulnerabilities were addressed through updates to the Zephyr RTOS. Users are advised to consult the Zephyr Project's official advisories and apply the relevant patches to secure their embedded systems. The timely disclosure and patching of these issues are crucial for maintaining the integrity and security of devices running the Zephyr OS.
The batch of disclosures highlights the importance of thorough validation, especially in security-sensitive components like memory management, system calls, and data handling in embedded operating systems. Continuous security audits and prompt patching remain paramount for the Zephyr Project and its users.