EUVD-2026-42037Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Local vector and AC:H reflect the flash-error-at-checkpoint prerequisite; PR:L covers application-level disk mount access; C and I are N as only kernel availability is impacted.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
The Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) implemented the dhara_nand_ callbacks so that, on a flash error, the error code was written unconditionally through the caller-supplied dhara_error_t err pointer (e.g. *err = DHARA_E_ECC in dhara_nand_read, and similar in dhara_nand_erase/prog/copy). The upstream Dhara library calls these callbacks with err == NULL along its journal-resume binary search: find_last_checkblock() invokes find_checkblock(j, mid, &found, NULL), which forwards the NULL pointer into dhara_nand_read(). This path runs during disk_ftl_access_init() -> dhara_map_resume() whenever the FTL disk is mounted/initialised. If a flash read error (uncorrectable ECC, bad block, controller error) occurs on one of the probed checkpoint pages, the driver dereferences and writes to NULL, faulting the kernel (denial of service). The trigger is conditioned on the NAND medium content/health, which can be influenced by media wear, induced faults, or a corrupted/crafted on-flash image. The fix routes all error assignments through the library's NULL-safe dhara_set_error() helper. Affects Zephyr v4.4.0, where the driver was introduced.
AnalysisAI
Kernel denial-of-service in Zephyr RTOS v4.4.0's Dhara flash translation layer driver crashes the system during FTL disk initialization when a flash error coincides with the journal-resume checkpoint scan. The driver's dhara_nand_read/erase/prog/copy callbacks unconditionally dereference the caller-supplied err pointer, but the upstream Dhara library legitimately passes NULL during its binary search in find_last_checkblock(), triggering a NULL write and kernel fault. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; exploitation is gated on specific flash media conditions (uncorrectable ECC, bad block, or induced fault) occurring on a checkpoint page at mount time, constraining real-world risk to physical or supply-chain threat models.
Technical ContextAI
Zephyr RTOS (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) introduced the Dhara flash translation layer disk driver in v4.4.0 via drivers/disk/ftl_dhara.c. The Dhara library is an open-source FTL providing journaling and wear-leveling for raw NAND flash. CWE-476 (NULL Pointer Dereference) is the root cause: the Zephyr driver implements dhara_nand_* callbacks that write the error code directly to the err pointer (e.g., *err = DHARA_E_ECC) without first checking for NULL. The upstream library's find_last_checkblock() performs a binary search during journal resume via dhara_map_resume(), calling find_checkblock(j, mid, &found, NULL) - propagating NULL into dhara_nand_read() as the err argument. This execution path is exercised at every FTL disk mount via disk_ftl_access_init(). The fix in commit a8371b0d4719efe37a66e2abb618ad9b81792212 routes all error assignments through the library's NULL-safe dhara_set_error() helper, eliminating the dereference.
RemediationAI
The upstream fix is available as commit a8371b0d4719efe37a66e2abb618ad9b81792212 in the Zephyr GitHub repository (https://github.com/zephyrproject-rtos/zephyr/commit/a8371b0d4719efe37a66e2abb618ad9b81792212), replacing direct err pointer writes with the NULL-safe dhara_set_error() helper. A formally tagged patched release version has not been independently confirmed from the available reference data; downstream integrators should apply the patch commit directly and monitor the Zephyr release channel and advisory at GHSA-q28v-3729-f82g. As a compensating control, disabling the Dhara FTL disk driver via its Kconfig option eliminates the vulnerable code path entirely, at the cost of losing Dhara FTL-managed NAND flash support. Where the driver must remain active, validating on-flash image integrity at provisioning time and restricting physical access to flash storage reduces the probability of triggering the vulnerable flash-error condition.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today