Memory Disclosure Vulnerability in Zephyr OS Charger Driver

CVE-2026-19809

What is CVE-2026-19809?

A memory disclosure vulnerability exists in the charger driver of Zephyr OS, specifically within the user-mode system call verifier z_vrfy_charger_get_prop(). This flaw arises from an uninitialized union, charger_propval, which is declared on the kernel stack. When this union is passed to the charger driver, it can lead to the leaking of sensitive kernel stack data to unprivileged user-mode threads. The issue can occur on both error and success pathways during the copy-out process, where residual bytes from the kernel stack may be unintentionally exposed. Vulnerable systems can leak up to 16 bytes of privileged memory, potentially allowing malicious users to glean kernel object addresses and exploit related memory-safety vulnerabilities. This vulnerability can be partially mitigated by implementing patches that skip erroneous copies and zero out the union before use.

References