User-Mode Syscall Verifier Vulnerability in Zephyr UART Driver

CVE-2026-90834

What is CVE-2026-90834?

This vulnerability in the Zephyr UART driver relates to improper validation in user-mode syscall verifiers for the 16-bit UART API. Specifically, the verification functions z_vrfy_uart_poll_out_u16(), z_vrfy_uart_tx_u16(), and z_vrfy_uart_rx_enable_u16() incorrectly run checks against the 8-bit operations. This flaw allows unprivileged user-mode threads to execute the corresponding system calls, potentially causing the system to halt due to a CPU exception as a result of an indirect call through a NULL function pointer. The vulnerability highlights the need for robust checks within the driver to maintain system integrity and prevent unauthorized service denial.

References