PT-2026-77335 · Unknown · Zephyr Kernel

CVE-2026-12631

·

Published

2026-08-18

·

Updated

2026-08-19

CVSS v3.1

6.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Zephyr kernel (affected versions not specified)
Description An issue exists in the validation of the k thread join() and k thread abort() system calls via the thread obj validate() function in kernel/thread.c. When k object validate() returns an error such as -EPERM (access denied) or -EBADF (invalid object type), the system incorrectly evaluates the non-zero error code as a success due to the behavior of K SYSCALL VERIFY MSG. This allows an unprivileged user-mode thread to bypass intended security checks by calling these system calls on thread objects it does not own.
Depending on the compiler used, this leads to different outcomes:
  • On Clang builds, it triggers an illegal-instruction trap, resulting in a local denial of service that crashes the kernel.
  • On GCC builds, it results in undefined behavior that may allow an access-control bypass, enabling the caller to execute the actual k thread join() or k thread abort() implementation for an unauthorized thread.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-12631
GHSA-CRFW-75JW-HJM3

Affected Products

Zephyr Kernel