CVE-2026-10659

Name of the Vulnerable Software and Affected Versions Zephyr version 4.4.0

Description The Dhara flash translation layer disk driver in drivers/disk/ftl dhara.c contains a flaw where dhara nand callbacks write error codes unconditionally to a caller-supplied dhara error t err pointer. During the journal-resume binary search, the find last checkblock() function calls find checkblock(), which passes a NULL pointer into dhara nand read(). This process occurs during disk ftl access init() and dhara map resume() when the FTL disk is mounted or initialized. If a flash read error—such as an uncorrectable ECC (Error Correction Code), bad block, or controller error—occurs on a probed checkpoint page, the driver dereferences the NULL pointer, leading to a kernel fault and denial of service. This can be triggered by media wear, induced faults, or a corrupted on-flash image.

Recommendations Update Zephyr version 4.4.0 to a version where error assignments are routed through the NULL-safe dhara set error() helper.