Floating Point ABI Vulnerability in Zephyr ARM Port by Zephyr Project

CVE-2026-11985

What is CVE-2026-11985?

A vulnerability exists in the Zephyr ARM port related to the handling of floating point ABI settings when enabling the hardware Floating Point Unit (FPU). If CONFIG_FPU_SHARING is disabled, the kernel fails to preserve the callee-saved floating point (FP) register state during thread context switches. This oversight can lead to information disclosure, as unprivileged threads may access leftover FP registers from victim threads, potentially leaking sensitive data. The vulnerability arises when the compiler generates floating point instructions in multiple threads, violating the precondition that only a single thread executes FP instructions. To mitigate this, the fix enforces the selection of CONFIG_FPU_SHARING whenever FP ABI settings are configured, ensuring the integrity of FP register states across context switches.

References