Local Privilege Escalation in Zephyr Flash Utility Kernel Driver

CVE-2026-9771

What is CVE-2026-9771?

The vulnerability in the flash_copy() system call exploited a lack of object validation in a specific handler, allowing unprivileged user-mode threads to pass invalid device pointers to the kernel. This could lead to arbitrary kernel code execution, local privilege escalation, and potential denial-of-service or information disclosure risks. A mitigation was implemented by verifying device pointers against permitted kernel objects before any dereference takes place, effectively closing this security gap.

References