Memory Leak Vulnerability in Zephyr RTOS Thread Management

CVE-2026-90589

What is CVE-2026-90589?

A memory leak vulnerability exists in the thread management component of Zephyr RTOS when CONFIG_THREAD_STACK_MEM_MAPPED is enabled. This issue occurs due to improper cleanup during the abortion of threads, where the thread stacks remain mapped in the kernel virtual address space after a thread is aborted by another thread. As a result, repeated thread creation and abortion can exhaust available kernel memory, ultimately leading to a denial of service as the system encounters kernel fatal errors. This vulnerability is particularly relevant in configurations that utilize memory-mapped thread stacks, affecting system stability and requiring a reboot to recover from the malfunction.

References