Zephyr RTOS CVE-2026-10670

Two build-time Kconfig options must both be enabled: CONFIG_USERSPACE=y (compiles in the userspace boundary and syscall verifiers) and CONFIG_THREAD_NAME=y (compiles in the k_thread_name_copy() syscall and its z_vrfy_ verifier). Without either option the vulnerable code path is not present in the firmware image. At runtime, the attacker must have execution capability as a low-privilege user-mode thread on the target device (PR:L per CVSS) - i.e., the attacker must already have unprivileged code running locally on the device. The syscall itself requires only a single invocation with a non-NULL but unregistered pointer value; no brute force, timing precision, or heap state is required. Remote exploitation is not possible without a separate initial access vector. The local-only attack vector (AV:L) and the non-default build configuration are the primary limiting factors that reduce real-world exposure beyond the raw CVSS score.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H with a base score of 5.5 accurately captures the risk profile: local low-privilege access is required, impact is confined to availability, and the scope is unchanged. The attack complexity is genuinely low - a single malformed syscall invocation is sufficient with no race conditions, heap grooming, or timing precision needed. However, real-world exposure is gated by two non-default build-time conditions (CONFIG_USERSPACE and CONFIG_THREAD_NAME both enabled), which meaningfully reduces the population of vulnerable deployed images. EPSS data was not provided in the input, so numerical exploitation probability cannot be quantified. No CISA KEV listing exists and no public POC exploit code was identified, consistent with no public exploit at time of analysis. Despite the moderate CVSS score, impact in embedded and safety-critical contexts (industrial IoT, medical devices, automotive) where Zephyr is deployed can be disproportionate: a kernel reboot may disrupt physical control loops, sensor sampling, or safety-critical actuator states. The local-only attack vector is the primary containment factor - remote exploitation is not possible without a separate initial foothold.

An attacker with low-privilege code execution on a Zephyr device - for example, a sandboxed application thread in a multi-tenant embedded system - calls k_thread_name_copy() passing an arbitrary non-NULL but unregistered memory address as the thread argument. The pre-fix verifier passes the thread == NULL check (since the address is non-NULL), then k_object_find() returns NULL for the unregistered pointer, and the verifier dereferences ko->type through the NULL pointer in supervisor mode. The resulting kernel-mode fault immediately halts or reboots the device, causing a full denial of service with no public exploit code required beyond a standard Zephyr syscall invocation.