{"id":"CVE-2026-90834","kind":"vulnerability","aliases":["CVE-2026-90834"],"related":[],"title":"Zephyr: wrong syscall check lets user threads crash the kernel","description":"The user-mode syscall verifiers for the 16-bit (\"wide data\") UART API in drivers/serial/uart_handlers.c validated the wrong driver operation. z_vrfy_uart_poll_out_u16(), z_vrfy_uart_tx_u16() and z_vrfy_uart_rx_enable_u16() each ran K_SYSCALL_DRIVER_UART() against the 8-bit op (poll_out, tx, rx_enable) rather than the 16-bit op that the corresponding implementation dereferences (poll_out_u16, tx_u16, rx_enable_u16). z_impl_uart_poll_out_u16(), z_impl_uart_tx_u16() and z_impl_uart_rx_enable_u16() in include/zephyr/drivers/uart/uart_internal.h call their op unconditionally, with no NULL guard of their own, because the verifier is supposed to have established that the op exists.\n\nCONFIG_UART_WIDE_DATA is an application-selectable option that no driver selects, and only a handful of the serial drivers in the tree implement any _u16 operation; every other driver leaves those struct uart_driver_api members NULL while still providing the 8-bit ops the old check inspected. In a build with CONFIG_USERSPACE and CONFIG_UART_WIDE_DATA (plus CONFIG_UART_ASYNC_API for the uart_tx_u16() and uart_rx_enable_u16() variants), an unprivileged user-mode thread that legitimately holds access to such a UART device object can invoke the _u16 syscall: the object, permission and op checks all pass, and the kernel-side implementation then performs an indirect call through a NULL function pointer while running at supervisor privilege.\n\nThe result is a CPU exception taken in kernel context instead of the intended K_OOPS or -ENOSYS return. With the default k_sys_fatal_error_handler() this halts the system (or warm-reboots it under CONFIG_RESET_ON_FATAL_ERROR), so a thread confined by the userspace sandbox can deny service to the whole device — a capability the user-mode privilege boundary is specifically meant to withhold. The call target is a fixed NULL, so there is no attacker-controlled code execution and no memory disclosure; the separate K_SYSCALL_MEMORY_ARRAY_READ()/K_SYSCALL_MEMORY_ARRAY_WRITE() bounds checks on the caller's buffer were and remain correct. The fix points each verifier at the matching _u16 op, using a plain K_SYSCALL_OBJ() object check where the op does not exist or where the implementation already tests it for NULL.","summary":"Zephyr's 16-bit UART syscall verifiers check the wrong driver operation, so a user-mode thread can call a NULL function pointer in kernel context. The result is a kernel fault that halts or reboots the device, a denial of service against the whole system.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","runtime","uart","userspace","zephyr"],"not_affected_if":["default-config","no-userspace","no-wide-data-uart"],"how_to_check":"- Check whether the build sets `CONFIG_USERSPACE` and `CONFIG_UART_WIDE_DATA` (plus `CONFIG_UART_ASYNC_API` for the tx and rx variants).\n- Look for user-mode threads that hold access to a UART device object and call `uart_poll_out_u16`, `uart_tx_u16` or `uart_rx_enable_u16`.","fix":null,"status":"open","published_at":"2026-11-10T22:21:14+00:00","first_seen_at":"2026-11-10T22:27:31+00:00","triaged_at":"2026-11-10T22:30:46+00:00","updated_at":"2026-11-10T22:30:46+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T22:30:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Zephyr: wrong syscall check lets user threads crash the kernel","impact":"low","summary":"Zephyr's 16-bit UART syscall verifiers check the wrong driver operation, so a user-mode thread can call a NULL function pointer in kernel context. The result is a kernel fault that halts or reboots the device, a denial of service against the whole system.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","uart","userspace"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Denial of service: the kernel faults and the whole device halts or reboots.","analyst_note":"Confirm the fixed Zephyr release and patch commit from the linked fix and advisory pages; the sources given do not state a version.","how_to_check":"- Check whether the build sets `CONFIG_USERSPACE` and `CONFIG_UART_WIDE_DATA` (plus `CONFIG_UART_ASYNC_API` for the tx and rx variants).\n- Look for user-mode threads that hold access to a UART device object and call `uart_poll_out_u16`, `uart_tx_u16` or `uart_rx_enable_u16`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","no-userspace","no-wide-data-uart"],"who_is_affected":"Only builds with user-mode (CONFIG_USERSPACE) and the 16-bit UART API (CONFIG_UART_WIDE_DATA) enabled are exposed. The bug is reached when a sandboxed user thread holds access to a UART device whose driver leaves the _u16 operations NULL, which is most serial drivers. Builds without those options, or without user threads touching UART, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00087,"input_tokens":5384,"output_tokens":664,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-90834':13A,16A '/k_syscall_memory_array_write':411C '16':24B,77C,127C '8':116C,230C 'access':273C 'alreadi':451C 'api':82C,223C,252C 'applic':193C 'application-select':192C 'array':409C 'async':251C 'attack':396C 'attacker-control':395C 'bit':25B,78C,117C,128C,231C 'bound':412C 'boundari':378C 'buffer':418C 'build':239C 'call':41B,163C,303C,385C 'caller':416C 'capabl':372C 'check':4A,29B,235C,290C,413C,440C 'code':398C 'config':186C,241C,244C,249C,351C 'confin':359C 'context':48B,323C 'control':397C 'correct':422C 'correspond':132C 'cpu':318C 'crash':8A 'cve':11A,14A 'data':80C,189C,247C 'default':335C 'deni':365C 'denial':62B 'derefer':134C 'devic':60B,278C,370C 'disclosur':403C 'driver':32B,88C,112C,198C,207C,217C,222C 'drivers/serial/uart_handlers.c':84C 'embed':17B 'enabl':106C,123C,141C,159C,261C 'enosi':331C 'error':339C,355C 'establish':181C 'everi':215C 'except':319C 'execut':399C 'exist':185C,446C 'fatal':338C,354C 'fault':54B 'fix':389C,424C 'function':44B,307C 'guard':170C 'halt':56B,342C 'hand':203C 'handler':340C 'hold':272C 'impl':144C,150C,156C 'implement':133C,211C,298C,450C 'include/zephyr/drivers/uart/uart_internal.h':162C 'indirect':302C 'inspect':236C 'instead':324C 'intend':327C 'invok':281C 'k':110C,328C,336C,406C,436C 'kernel':10A,47B,53B,296C,322C 'kernel-sid':295C 'leav':218C 'legitim':271C 'let':5A 'match':430C 'meant':381C 'member':224C 'memori':402C,408C 'mode':38B,72C,268C,376C 'null':43B,169C,225C,306C,390C,455C 'obj':438C 'object':279C,286C,439C 'old':234C 'oop':329C 'op':118C,129C,165C,184C,232C,289C,432C,443C 'oper':33B,89C,214C 'option':195C 'pass':292C 'perform':300C 'permiss':287C 'plain':435C 'plus':248C 'point':425C 'pointer':45B,308C 'poll':93C,119C,135C,146C 'privileg':313C,377C 'provid':228C 'ran':109C 'rather':124C 'read':410C 'reboot':58B,348C 'remain':421C 'reset':352C 'result':50B,315C 'return':332C 'run':310C 'runtim':18B 'rx':105C,122C,140C,158C,260C 'sandbox':363C 'select':194C,199C 'separ':405C 'serial':206C 'servic':64B,366C 'side':297C 'specif':380C 'still':227C 'struct':220C 'supervisor':312C 'suppos':178C 'sys':337C 'syscal':3A,27B,73C,111C,284C,407C,437C 'system':68B,344C 'taken':320C 'target':386C 'test':452C 'thread':7A,39B,269C,358C 'tree':210C 'tx':99C,121C,138C,152C,256C 'u16':95C,100C,107C,137C,139C,142C,148C,153C,160C,213C,257C,262C,283C,431C 'uart':19B,26B,81C,92C,98C,104C,113C,145C,151C,157C,187C,221C,245C,250C,255C,259C,277C 'uncondit':166C 'unprivileg':265C 'use':433C 'user':6A,37B,71C,267C,375C 'user-mod':36B,70C,266C,374C 'userspac':20B,242C,362C 'valid':85C 'variant':263C 'verifi':28B,74C,176C,427C 'vrfi':91C,97C,103C 'warm':347C 'warm-reboot':346C 'whole':67B,369C 'wide':79C,188C,246C 'withhold':383C 'wrong':2A,31B,87C 'z':90C,96C,102C,143C,149C,155C 'zephyr':1A,21B,22B","nicknames":[],"mitigations":[],"who_affected":"Only builds with user-mode (CONFIG_USERSPACE) and the 16-bit UART API (CONFIG_UART_WIDE_DATA) enabled are exposed. The bug is reached when a sandboxed user thread holds access to a UART device whose driver leaves the _u16 operations NULL, which is most serial drivers. Builds without those options, or without user threads touching UART, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","medium","runtime","uart","userspace","zephyr"],"campaign_type":null,"search_a":"'-2026':12A,15A '-90834':13A,16A 'check':4A 'crash':8A 'cve':11A,14A 'kernel':10A 'let':5A 'syscal':3A 'thread':7A 'user':6A 'wrong':2A 'zephyr':1A","search_b":"'16':24B 'bit':25B 'call':41B 'check':29B 'context':48B 'denial':62B 'devic':60B 'driver':32B 'embed':17B 'fault':54B 'function':44B 'halt':56B 'kernel':47B,53B 'mode':38B 'null':43B 'oper':33B 'pointer':45B 'reboot':58B 'result':50B 'runtim':18B 'servic':64B 'syscal':27B 'system':68B 'thread':39B 'uart':19B,26B 'user':37B 'user-mod':36B 'userspac':20B 'verifi':28B 'whole':67B 'wrong':31B 'zephyr':21B,22B","search_c":"'/k_syscall_memory_array_write':411C '16':77C,127C '8':116C,230C 'access':273C 'alreadi':451C 'api':82C,223C,252C 'applic':193C 'application-select':192C 'array':409C 'async':251C 'attack':396C 'attacker-control':395C 'bit':78C,117C,128C,231C 'bound':412C 'boundari':378C 'buffer':418C 'build':239C 'call':163C,303C,385C 'caller':416C 'capabl':372C 'check':235C,290C,413C,440C 'code':398C 'config':186C,241C,244C,249C,351C 'confin':359C 'context':323C 'control':397C 'correct':422C 'correspond':132C 'cpu':318C 'data':80C,189C,247C 'default':335C 'deni':365C 'derefer':134C 'devic':278C,370C 'disclosur':403C 'driver':88C,112C,198C,207C,217C,222C 'drivers/serial/uart_handlers.c':84C 'enabl':106C,123C,141C,159C,261C 'enosi':331C 'error':339C,355C 'establish':181C 'everi':215C 'except':319C 'execut':399C 'exist':185C,446C 'fatal':338C,354C 'fix':389C,424C 'function':307C 'guard':170C 'halt':342C 'hand':203C 'handler':340C 'hold':272C 'impl':144C,150C,156C 'implement':133C,211C,298C,450C 'include/zephyr/drivers/uart/uart_internal.h':162C 'indirect':302C 'inspect':236C 'instead':324C 'intend':327C 'invok':281C 'k':110C,328C,336C,406C,436C 'kernel':296C,322C 'kernel-sid':295C 'leav':218C 'legitim':271C 'match':430C 'meant':381C 'member':224C 'memori':402C,408C 'mode':72C,268C,376C 'null':169C,225C,306C,390C,455C 'obj':438C 'object':279C,286C,439C 'old':234C 'oop':329C 'op':118C,129C,165C,184C,232C,289C,432C,443C 'oper':89C,214C 'option':195C 'pass':292C 'perform':300C 'permiss':287C 'plain':435C 'plus':248C 'point':425C 'pointer':308C 'poll':93C,119C,135C,146C 'privileg':313C,377C 'provid':228C 'ran':109C 'rather':124C 'read':410C 'reboot':348C 'remain':421C 'reset':352C 'result':315C 'return':332C 'run':310C 'rx':105C,122C,140C,158C,260C 'sandbox':363C 'select':194C,199C 'separ':405C 'serial':206C 'servic':366C 'side':297C 'specif':380C 'still':227C 'struct':220C 'supervisor':312C 'suppos':178C 'sys':337C 'syscal':73C,111C,284C,407C,437C 'system':344C 'taken':320C 'target':386C 'test':452C 'thread':269C,358C 'tree':210C 'tx':99C,121C,138C,152C,256C 'u16':95C,100C,107C,137C,139C,142C,148C,153C,160C,213C,257C,262C,283C,431C 'uart':81C,92C,98C,104C,113C,145C,151C,157C,187C,221C,245C,250C,255C,259C,277C 'uncondit':166C 'unprivileg':265C 'use':433C 'user':71C,267C,375C 'user-mod':70C,266C,374C 'userspac':242C,362C 'valid':85C 'variant':263C 'verifi':74C,176C,427C 'vrfi':91C,97C,103C 'warm':347C 'warm-reboot':346C 'whole':369C 'wide':79C,188C,246C 'withhold':383C 'wrong':87C 'z':90C,96C,102C,143C,149C,155C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:02:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90834","severity":null,"published_at":"2026-11-10T22:21:14+00:00","modified_at":"2026-11-10T22:21:14+00:00","first_seen_at":"2026-11-10T22:27:31+00:00","fetched_at":"2026-11-10T22:27:31+00:00","note":null}],"documents":[{"id":119556,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/3c13bfd3d3ccdceeb51b884fed5a8d2a49475484","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":119557,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xvwx-ww79-r346","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T22:02:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}