CVE-2026-12233

Awaiting Analysis Awaiting Analysis - Queue

PSA Protected Storage mutex uninitialized wait queue kernel panic

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: Zephyr Project

Description

The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-filled static struct k_mutex credential_lock; and never called k_mutex_init() on it. A statically zero-filled k_mutex has an uninitialized wait queue (its dlist head/tail are NULL instead of the self-referential sentinels that k_mutex_init/K_MUTEX_DEFINE install). The uncontended lock path does not touch the wait queue, so the defect is latent and serialized use behaves correctly. When two execution contexts contend on the lock, k_mutex_lock() pends the blocking thread on the wait queue via z_pend_curr(), which calls sys_dlist_append() on the zeroed list and dereferences a NULL tail pointer (tail->next = node), faulting the kernel. The lock is held during TLS handshake credential loading and by all credential add/get/delete operations, so a deployment performing concurrent TLS handshakes (for example a server handling multiple simultaneous connections from a remote peer) or a credential-management operation concurrent with a handshake can trigger the dereference. The impact is a denial of service: a deterministic kernel panic / device reset on the first contention. There is no memory corruption beyond the NULL dereference and no confidentiality or integrity impact; mutual exclusion on the fast path remains correct. Exposure is limited to builds with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE enabled (PSA Protected Storage / TF-M platforms); the default volatile RAM backend initializes its lock correctly and is unaffected. The fix initializes the mutex statically with K_MUTEX_DEFINE(credential_lock), providing a valid wait queue so the contended path no longer touches a NULL list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-12233

EUVD

EUVD-2026-57067

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	From 3.2.0 (inc) to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-665	The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Attack-Flow Graph

Executive Summary

This vulnerability involves an uninitialized mutex in the Zephyr RTOS TLS trusted-credential backend. The mutex was declared as a zero-filled static struct without proper initialization, leading to a NULL pointer dereference when two execution contexts contend on the lock. This causes a kernel panic or device reset, resulting in a denial of service.

Detection Guidance

Detection requires checking if your Zephyr RTOS build uses CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE and if the mutex is improperly initialized. Inspect the compiled binary or source for the mutex declaration in tls_credentials_trusted.c. No direct commands detect this without code inspection or runtime testing.

Impact Analysis

The impact is a denial of service due to a deterministic kernel panic or device reset when the mutex is contended. This can occur during concurrent TLS handshakes or credential operations, causing the system to crash. No memory corruption or data leaks occur beyond the DoS effect.

Compliance Impact

This vulnerability causes a kernel panic or device reset under contention, leading to a denial of service. While it does not directly impact confidentiality or integrity, the resulting system unavailability could violate compliance requirements for availability in standards like GDPR (Article 32) or HIPAA (Security Rule).

Mitigation Strategies

Apply the patch by updating to a fixed Zephyr RTOS version (v3.7+, v4.3+, or main branch) or backport the fix. Ensure CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE is disabled if not required. Rebuild and redeploy the firmware.

Hi! I’m here to help you understand CVE-2026-12233. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70