EUVD-2026-42037Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Local vector and AC:H reflect the flash-error-at-checkpoint prerequisite; PR:L covers application-level disk mount access; C and I are N as only kernel availability is impacted.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
The Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) implemented the dhara_nand_ callbacks so that, on a flash error, the error code was written unconditionally through the caller-supplied dhara_error_t err pointer (e.g. *err = DHARA_E_ECC in dhara_nand_read, and similar in dhara_nand_erase/prog/copy). The upstream Dhara library calls these callbacks with err == NULL along its journal-resume binary search: find_last_checkblock() invokes find_checkblock(j, mid, &found, NULL), which forwards the NULL pointer into dhara_nand_read(). This path runs during disk_ftl_access_init() -> dhara_map_resume() whenever the FTL disk is mounted/initialised. If a flash read error (uncorrectable ECC, bad block, controller error) occurs on one of the probed checkpoint pages, the driver dereferences and writes to NULL, faulting the kernel (denial of service). The trigger is conditioned on the NAND medium content/health, which can be influenced by media wear, induced faults, or a corrupted/crafted on-flash image. The fix routes all error assignments through the library's NULL-safe dhara_set_error() helper. Affects Zephyr v4.4.0, where the driver was introduced.
AnalysisAI
Kernel denial-of-service in Zephyr RTOS v4.4.0's Dhara flash translation layer driver crashes the system during FTL disk initialization when a flash error coincides with the journal-resume checkpoint scan. The driver's dhara_nand_read/erase/prog/copy callbacks unconditionally dereference the caller-supplied err pointer, but the upstream Dhara library legitimately passes NULL during its binary search in find_last_checkblock(), triggering a NULL write and kernel fault. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; exploitation is gated on specific flash media conditions (uncorrectable ECC, bad block, or induced fault) occurring on a checkpoint page at mount time, constraining real-world risk to physical or supply-chain threat models.
Technical ContextAI
Zephyr RTOS (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) introduced the Dhara flash translation layer disk driver in v4.4.0 via drivers/disk/ftl_dhara.c. The Dhara library is an open-source FTL providing journaling and wear-leveling for raw NAND flash. CWE-476 (NULL Pointer Dereference) is the root cause: the Zephyr driver implements dhara_nand_* callbacks that write the error code directly to the err pointer (e.g., *err = DHARA_E_ECC) without first checking for NULL. The upstream library's find_last_checkblock() performs a binary search during journal resume via dhara_map_resume(), calling find_checkblock(j, mid, &found, NULL) - propagating NULL into dhara_nand_read() as the err argument. This execution path is exercised at every FTL disk mount via disk_ftl_access_init(). The fix in commit a8371b0d4719efe37a66e2abb618ad9b81792212 routes all error assignments through the library's NULL-safe dhara_set_error() helper, eliminating the dereference.
RemediationAI
The upstream fix is available as commit a8371b0d4719efe37a66e2abb618ad9b81792212 in the Zephyr GitHub repository (https://github.com/zephyrproject-rtos/zephyr/commit/a8371b0d4719efe37a66e2abb618ad9b81792212), replacing direct err pointer writes with the NULL-safe dhara_set_error() helper. A formally tagged patched release version has not been independently confirmed from the available reference data; downstream integrators should apply the patch commit directly and monitor the Zephyr release channel and advisory at GHSA-q28v-3729-f82g. As a compensating control, disabling the Dhara FTL disk driver via its Kconfig option eliminates the vulnerable code path entirely, at the cost of losing Dhara FTL-managed NAND flash support. Where the driver must remain active, validating on-flash image integrity at provisioning time and restricting physical access to flash storage reduces the probability of triggering the vulnerable flash-error condition.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today