CVE-2026-10670

Name of the Vulnerable Software and Affected Versions Zephyr versions 2.0.0 through 4.4.0

Description In builds with CONFIG USERSPACE and CONFIG THREAD NAME enabled, the z vrfy k thread name copy() function in kernel/thread.c for the k thread name copy() system call fails to properly validate the return value of k object find(). When an unprivileged user-mode thread provides a non-NULL but unregistered pointer, the verifier dereferences a NULL pointer to read ko->type. Since the syscall verifier operates in supervisor mode, this results in a kernel-mode fault that can halt or reboot the system, leading to a denial of service.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary mitigation, disable CONFIG USERSPACE or CONFIG THREAD NAME in the build configuration.