Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-11985— Cross-thread FPU register leak on ARM when FPU enabled without register sharing

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

zephyrproject zephyr是zephyrproject组织开源的一个面向物联网设备的实时操作系统。 zephyrproject zephyr 1.13.0版本至4.4.1版本存在信息泄露漏洞，该漏洞源于ARM端口启用硬件FPU时未正确启用FPU寄存器共享，导致上下文切换时未保存调用者保存的浮点寄存器状态，可能造成信息泄露或跨线程FP状态损坏。

CVSS 3.6 · Low EPSS 0.12% · P2

Possible ATT&CK Techniques 2 AI

T1044 T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 1.13.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-11985

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-thread FPU register leak on ARM when FPU enabled without register sharing
Source: CVE Program / CVE List V5
Vulnerability Description
On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the callee-saved FP registers (s16-s31 / d8-d15) are only saved and restored across a context switch when CONFIG_FPU_SHARING is enabled (arch/arm/core/cortex_m/swap_helper.S and arch/arm/core/cortex_a_r/swap_helper.S), and prior to this fix selecting an ABI did not enable FPU register sharing, which defaults off. In a build that enables the FPU with the default ABI but leaves CONFIG_FPU_SHARING disabled, the kernel preserves no callee-saved FP register state across thread switches. The documented precondition for this "unshared" mode — that only a single thread ever executes FP instructions — is silently violated because the compiler may generate FP instructions in every thread. Under CONFIG_USERSPACE, where threads are mutually isolated, this becomes an information-disclosure boundary crossing: a victim thread can leave secret-derived values in s16-s31, and a co-resident unprivileged thread can read those registers directly (FP register access is not privilege-gated), recovering data left behind by another thread. Without userspace the same defect causes cross-thread FP state corruption (a correctness fault). The leak is bounded to the 16 callee-saved single-precision registers and is opportunistic, so impact is low. The fix makes FP_HARDABI and FP_SOFTABI select CONFIG_FPU_SHARING and tags every thread with K_FP_REGS at creation, so callee-saved FP state is always preserved across context switches whenever the compiler may emit FP instructions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
zephyrproject zephyr 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
zephyrproject zephyr是zephyrproject组织开源的一个面向物联网设备的实时操作系统。 zephyrproject zephyr 1.13.0版本至4.4.1版本存在信息泄露漏洞，该漏洞源于ARM端口启用硬件FPU时未正确启用FPU寄存器共享，导致上下文切换时未保存调用者保存的浮点寄存器状态，可能造成信息泄露或跨线程FP状态损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 1.13.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-11985

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-11985

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-11985 (1)

Vendor Advisories for CVE-2026-11985 (1)

Same Patch Batch · zephyrproject · 2026-08-11 · 5 CVEs total

CVE-2026-11893 5.9 MEDIUM Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)
CVE-2026-11894 5.9 MEDIUM Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths
CVE-2026-12052 5.2 MEDIUM Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the r
CVE-2026-12051 4.6 MEDIUM NULL pointer dereference in USB DFU device_next download handler (handle_download)

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-200

V. Comments for CVE-2026-11985

No comments yet

Leave a comment