PT-2026-77335
CVE-2026-12631
·
Published
2026-08-18
·
Updated
2026-08-19
Description by
CVSS 3.1
6.5
MediumMetricsAV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions
Zephyr kernel (affected versions not specified)
Description
An issue exists in the validation of the
k thread join() and k thread abort() system calls via the thread obj validate() function in kernel/thread.c. When k object validate() returns an error such as -EPERM (access denied) or -EBADF (invalid object type), the system incorrectly evaluates the non-zero error code as a success due to the behavior of K SYSCALL VERIFY MSG. This allows an unprivileged user-mode thread to bypass intended security checks by calling these system calls on thread objects it does not own.Depending on the compiler used, this leads to different outcomes:
- On Clang builds, it triggers an illegal-instruction trap, resulting in a local denial of service that crashes the kernel.
- On GCC builds, it results in undefined behavior that may allow an access-control bypass, enabling the caller to execute the actual
k thread join()ork thread abort()implementation for an unauthorized thread.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾