CVE-2026-12631

Received Received - Intake

Privilege Escalation in Zephyr RTOS Kernel

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Zephyr Project

Description

The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate() in kernel/thread.c. Its default switch branch is the access-denied path, taken when k_object_validate() returns -EPERM (the calling user thread was never granted access to the target thread object) or -EBADF (the supplied pointer is not a registered kernel object of the right type). That branch invoked K_OOPS(K_SYSCALL_VERIFY_MSG(ret, "access denied")), but K_SYSCALL_VERIFY_MSG treats a true expression as success; the non-zero error code ret therefore read as "verified OK", the kernel oops was never raised, and control fell through to CODE_UNREACHABLE. Because k_thread_join() and k_thread_abort() are system calls, an unprivileged user-mode thread (under CONFIG_USERSPACE) can reach this denial path directly by calling either syscall on a thread object it does not own. Instead of the offending thread being cleanly terminated, execution reaches __builtin_unreachable() while running in supervisor mode inside the syscall handler. On Clang builds CODE_UNREACHABLE emits an illegal-instruction trap, so a user thread can deterministically crash the kernel — a locally triggerable denial of service that escapes the userspace sandbox. On GCC builds the path is undefined behavior: the compiler may drop the return-value handling for thread_obj_validate(), so it can return an undefined bool; if that is false, the caller proceeds into the real k_thread_join()/k_thread_abort() implementation for a thread the user was never authorized to access, an access-control bypass. The fix changes the verification expression to ret == 0, so a denied (non-zero) result now correctly raises K_OOPS and terminates the offending caller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-12631

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Zephyr RTOS kernel where unprivileged user threads can trigger a denial of service or access control bypass. The issue lies in the validation of system calls k_thread_join() and k_thread_abort(). When a user thread without proper access attempts these calls, the kernel incorrectly treats the error as success due to flawed logic in K_SYSCALL_VERIFY_MSG. This leads to either a kernel crash (on Clang builds) or unauthorized access to thread operations (on GCC builds).

Detection Guidance

This vulnerability is specific to the Zephyr RTOS kernel and requires kernel-level access to detect. It involves improper validation in k_thread_join() and k_thread_abort() system calls. Detection would involve inspecting kernel logs for illegal instruction traps or unexpected kernel crashes, particularly on Clang builds. No standard network commands apply.

Impact Analysis

An attacker with local access could exploit this to crash the entire system (denial of service) or bypass security controls to manipulate threads they do not own. This could disrupt critical operations in embedded systems using Zephyr RTOS, especially those with CONFIG_USERSPACE enabled.

Mitigation Strategies

Apply the official patch from Zephyr Project that changes the verification expression to ret == 0. This ensures denied access attempts correctly raise a kernel oops. Until patched, avoid using CONFIG_USERSPACE or restrict access to unprivileged users.

Hi! I’m here to help you understand CVE-2026-12631. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70