CVE-2026-12233

Name of the Vulnerable Software and Affected Versions Zephyr OS (affected versions not specified)

Description The PSA Protected Storage credential backend in subsys/net/lib/tls credentials/tls credentials trusted.c fails to initialize the credential lock mutex. Because the mutex is declared as a zero-filled static struct without calling k mutex init(), it lacks a valid wait queue. While serialized use functions normally, contention between two execution contexts during TLS handshake credential loading or credential add/get/delete operations causes k mutex lock() to call z pend curr(), which then invokes sys dlist append(). This results in a NULL pointer dereference when accessing the tail of the uninitialized list, leading to a kernel panic and device reset. This issue specifically affects builds with CONFIG TLS CREDENTIALS BACKEND PROTECTED STORAGE enabled, such as PSA Protected Storage or TF-M platforms.

Recommendations Initialize the mutex statically using K MUTEX DEFINE(credential lock) to ensure a valid wait queue is provided. As a temporary mitigation, restrict the use of the CONFIG TLS CREDENTIALS BACKEND PROTECTED STORAGE configuration if possible.