User-Mode Syscall Vulnerability in Zephyr Charger Driver by Zephyr Project
CVE-2026-91007

7.8HIGH

Key Information:

Vendor

Zephyrproject

Status
Zephyr
Vendor
CVE Published:
12 November 2026

What is CVE-2026-91007?

A vulnerability exists in the Zephyr charger driver API where user-mode syscall verifiers fail to properly inspect the properties passed to the driver's set_property callback. This oversight allows an unprivileged user-mode thread to hijack control flow at kernel privilege by passing arbitrary pointers, thus defeating the isolation intended by CONFIG_USERSPACE. The vulnerability can lead to unintended invocations of function pointers declared in the union charger_propval, specifically via CHARGER_PROP_STATUS_NOTIFICATION and CHARGER_PROP_ONLINE_NOTIFICATION, resulting in potential security breaches through misused charger device interfaces. The fix implements strict verification and outright rejection of problematic properties, enhancing the overall security posture.

Affected Version(s)

zephyr 3.7.0 < 4.3.2

zephyr 4.4.0 < 4.5.0

References

https://github.com/zephyrproject-rtos/zephyr/commit/5467b...
patch
https://github.com/zephyrproject-rtos/zephyr/security/adv...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.