Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-10670: Zephyr kernel can crash when user sets thread name
CVE-2026-10670 · published 3 months ago
Summary
If a user‑level program in Zephyr tries to name a thread using an invalid pointer, the kernel may access a null value and stop working, causing the device to reboot or freeze. This can happen on any Zephyr version up to 4.4.0 that uses user‑space and thread‑naming features. Updating to a version that includes the fix or disabling those features will prevent the crash.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zephyrproject | zephyr |
< 4.5.0 >= 2.0.0, < 4.5.0 < 4.3.1 |
Original advisory text
User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier
The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_find() on the caller-supplied thread pointer and then dereferences the returned struct k_object without checking it for NULL. k_object_find() returns NULL whenever the supplied pointer is not a registered (static or dynamic) kernel object.
The pre-fix guard tested thread == NULL instead of ko == NULL, so an unprivileged user-mode thread that invokes k_thread_name_copy() with any non-NULL but unregistered pointer (e.g. an arbitrary address) passes the NULL test, after which the verifier reads ko->type through a NULL pointer.
Because the syscall verifier runs in supervisor mode, this NULL dereference is a kernel-mode fault that halts or reboots the system, allowing untrusted user code to crash the kernel across the userspace security boundary (denial of service). The marshaller passes the thread argument to the verifier without any prior K_SYSCALL_OBJ validation, so the bad pointer reaches the defect directly.
The flaw affects builds with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled and has been present since the special-case lookup was introduced around v2.0.0; it is present in v4.4.0 and earlier. The fix changes the guard to check the k_object_find() return value (ko == NULL) before dereferencing it.
The pre-fix guard tested thread == NULL instead of ko == NULL, so an unprivileged user-mode thread that invokes k_thread_name_copy() with any non-NULL but unregistered pointer (e.g. an arbitrary address) passes the NULL test, after which the verifier reads ko->type through a NULL pointer.
Because the syscall verifier runs in supervisor mode, this NULL dereference is a kernel-mode fault that halts or reboots the system, allowing untrusted user code to crash the kernel across the userspace security boundary (denial of service). The marshaller passes the thread argument to the verifier without any prior K_SYSCALL_OBJ validation, so the bad pointer reaches the defect directly.
The flaw affects builds with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled and has been present since the special-case lookup was introduced around v2.0.0; it is present in v4.4.0 and earlier. The fix changes the guard to check the k_object_find() return value (ko == NULL) before dereferencing it.
References
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-82h2-v4vm-... Vendor Advisory
- https://github.com/zephyrproject-rtos/zephyr/commit/491583951036bc5794a3843a4baa... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10670... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-10670 Vendor Advisory
- https://github.com/zephyrproject-rtos/zephyr Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published14 Jul 2026
Updated26 Oct 2026
First seen14 Jul 2026
Track software like this
Free during beta