Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-9771— Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zephyr Project Zephyr是Zephyr Project组织开源的一款实时操作系统。 Zephyr Project Zephyr 4.0.0版本至4.4.2之前版本存在安全漏洞，该漏洞源于drivers/flash/flash_util.c中的flash_copy()系统调用未对src_dev和dst_dev设备指针进行对象验证，用户态线程可通过伪造struct device及驱动API函数指针，使内核在超级用户模式下执行任意代码，或导致内核崩溃和越界读取，进而造成权限提升。

CVSS 8.8 · High EPSS 0.11% · P1

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.0.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-9771

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation
Source: CVE Program / CVE List V5
Vulnerability Description
The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer (K_SYSCALL_MEMORY_WRITE) and passed the two struct device * arguments, src_dev and dst_dev, directly into the implementation without any object validation — unlike every sibling flash syscall, which guards its device pointer with K_SYSCALL_DRIVER_FLASH. A user-mode thread fully controls the values of src_dev/dst_dev and the contents of its own address space. The implementation z_impl_flash_copy() dereferences these pointers and calls through their driver-API function tables (e.g. api->get_parameters(dst_dev), flash_read(src_dev, ...), flash_write(dst_dev, ...)). By supplying a pointer to a forged struct device whose api table contains attacker-chosen function pointers, an unprivileged thread can cause the kernel to call arbitrary code in supervisor mode; passing any arbitrary or invalid address otherwise yields a kernel crash or out-of-bounds read. The result is a local privilege escalation out of the userspace sandbox (with kernel denial-of-service and information disclosure as lesser outcomes). The fix adds K_SYSCALL_DRIVER_FLASH(src_dev, read) and K_SYSCALL_DRIVER_FLASH(dst_dev, write) to z_vrfy_flash_copy(), which verify each device is a registered flash-driver kernel object the calling thread is permitted to use before any dereference, closing the path completely.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
非可信指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
Zephyr Project Zephyr 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Zephyr Project Zephyr是Zephyr Project组织开源的一款实时操作系统。 Zephyr Project Zephyr 4.0.0版本至4.4.2之前版本存在安全漏洞，该漏洞源于drivers/flash/flash_util.c中的flash_copy()系统调用未对src_dev和dst_dev设备指针进行对象验证，用户态线程可通过伪造struct device及驱动API函数指针，使内核在超级用户模式下执行任意代码，或导致内核崩溃和越界读取，进而造成权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.0.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-9771

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9771

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-9771 (1)

Vendor Advisories for CVE-2026-9771 (1)

Same Patch Batch · zephyrproject · 2026-08-17 · 4 CVEs total

CVE-2026-12519 5.0 MEDIUM Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing
CVE-2026-12629 4.6 MEDIUM PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denia
CVE-2026-12630 4.3 MEDIUM 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-822

V. Comments for CVE-2026-9771

No comments yet

Leave a comment