Zephyr RTOS CVE-2026-10659

Exploitation requires all of the following conditions simultaneously: the target device runs Zephyr v4.4.0 with the Dhara FTL disk driver compiled and enabled; a NAND flash device is managed by the Dhara FTL layer; and one of the probed Dhara journal checkpoint pages returns a flash read error - specifically uncorrectable ECC, a bad block, or a hardware controller error - during the journal-resume binary search executed at FTL initialization (disk_ftl_access_init() → dhara_map_resume()). The flash error condition can arise from natural media wear, hardware fault, or deliberate corruption of the on-flash image. Exploitation is further limited by: a local-only attack vector with no network path; high attack complexity requiring a flash error on a specific checkpoint page at the precise moment of mount; need for physical or supply-chain-level influence over flash media content; and restriction to the single Zephyr version that introduced the driver.

The CVSS 3.1 base score of 4.7 (Medium) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the constrained threat model: local-only attack vector, high exploitation complexity, and availability-only impact. The AC:H designation is appropriate because a flash read error must occur specifically on a checkpoint page during the binary search scan at initialization - a condition that cannot be reliably forced from software alone and typically requires physical media access, induced wear, or a crafted on-flash image. No EPSS score was provided in the input data. The CVE is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified. In practice, risk is bounded to Zephyr v4.4.0 deployments using Dhara FTL-managed NAND flash with degraded, corrupted, or adversarially prepared media - limiting the realistic attacker profile to physical access or supply-chain actors. There is no confidentiality or integrity impact, and the scope remains unchanged within the affected system.

An attacker with physical access to a Zephyr v4.4.0 device - or one who can provision a crafted NAND flash image during manufacturing or supply-chain handling - induces an uncorrectable ECC error or bad block on one of the Dhara journal checkpoint pages. When the device boots and the FTL disk initializes, dhara_map_resume() performs a binary search over checkpoint pages, passing NULL as the error pointer; the driver dereferences NULL upon encountering the flash error, faulting the kernel and crashing the device. No public exploit code exists for this vulnerability at time of analysis.