CVE-2026-11985

Name of the Vulnerable Software and Affected Versions Zephyr ARM port (affected versions not specified)

Description On the ARM port, enabling the hardware FPU via CONFIG FPU forces a Floating point ABI choice, defaulting to CONFIG FP HARDABI. Both FP HARDABI and FP SOFTABI allow the compiler to emit hardware FP instructions in any function, regardless of whether floating-point types are used. However, callee-saved FP registers (s16-s31 / d8-d15) are only saved and restored during a context switch if CONFIG FPU SHARING is enabled. Previously, selecting an ABI did not automatically enable this sharing, which defaults to off.

When the FPU is enabled with the default ABI but CONFIG FPU SHARING is disabled, the kernel fails to preserve callee-saved FP register state across thread switches. In environments using CONFIG USERSPACE, this leads to an information-disclosure boundary crossing where an unprivileged thread can read secret-derived values left in registers s16-s31 by a victim thread. In environments without userspace, this results in cross-thread FP state corruption. The leak is limited to 16 callee-saved single-precision registers.

Recommendations Enable CONFIG FPU SHARING when using FP HARDABI or FP SOFTABI to ensure callee-saved FP state is preserved across context switches.