Mutex Initialization Flaw in PSA Protected Storage on Zephyr OS

CVE-2026-12233

What is CVE-2026-12233?

A flaw in the PSA Protected Storage credential backend on Zephyr OS allows for a denial of service via a mutex initialization issue. The mutex associated with credential storage was improperly declared, leading to a NULL pointer dereference when contention occurs on the lock. This vulnerability can be triggered during simultaneous TLS handshakes or credential management tasks, resulting in a kernel panic or device reset. Correct mutex initialization is essential to avoid these issues, and the vulnerability is limited to specific builds with the CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE enabled.

References