CVE-2026-9771

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description In builds with CONFIG USERSPACE enabled, the flash copy() system call fails to properly validate the src dev and dst dev arguments within the z vrfy flash copy() function in drivers/flash/flash util.c. While the output buffer is validated, the device pointers are passed directly to the z impl flash copy() implementation without object validation. An unprivileged user-mode thread can provide a pointer to a forged device structure containing attacker-controlled function pointers. When the kernel dereferences these pointers to call driver-API functions such as get parameters(), flash read(), or flash write(), it can lead to arbitrary code execution in supervisor mode, local privilege escalation, kernel denial-of-service, or information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.