PT-2026-72076 · Git+1 · Zephyr

CVE-2026-12364

·

Published

2026-08-14

·

Updated

2026-08-26

CVSS v3.1

8.4

High

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)
Description The user-space system-call verifier z vrfy z log msg static create() in subsys/logging/log msg.c fails to perform mandatory K SYSCALL * checks, acting as a pass-through that forwards caller-supplied arguments directly to the kernel-mode implementation z impl z log msg static create(). When CONFIG USERSPACE is enabled, unprivileged user-mode threads can invoke z log msg static create() with controlled arguments. The kernel-mode handler dereferences these untrusted values through the following functions:
  • frontend runtime filtering() reads the source pointer.
  • cbprintf package copy() reads desc.package len bytes from the package pointer.
  • z log msg finalize() performs a memcpy() of desc.data len bytes from the data pointer.
This allows a user thread to provide arbitrary kernel addresses and lengths, leading to a kernel-mode denial of service via kernel faults or the disclosure of arbitrary kernel memory if the log backend output is observable to the attacker.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Untrusted Pointer Dereference

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-822

Related Identifiers

CVE-2026-12364
GHSA-H7RF-G9MG-G23F

Affected Products

Zephyr