What is the CVSS score of CVE-2026-10670?

CVE-2026-10670 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-10670?

Yes, a patch is available for CVE-2026-10670. Update the affected software to the latest version immediately.

Zephyr RTOS CVE-2026-10670

EUVD-2026-43697 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-14 zephyr

Denial Of Service Null Pointer Dereference Zephyr

5.5

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Requires low-privilege local thread execution (AV:L/PR:L); kernel crash yields complete availability loss (A:H) with zero confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 15:41 vuln.today

Analysis Generated

Jul 14, 2026 - 15:41 vuln.today

DescriptionCVE.org

The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_find() on the caller-supplied thread pointer and then dereferences the returned struct k_object without checking it for NULL. k_object_find() returns NULL whenever the supplied pointer is not a registered (static or dynamic) kernel object.

The pre-fix guard tested thread NULL instead of ko NULL, so an unprivileged user-mode thread that invokes k_thread_name_copy() with any non-NULL but unregistered pointer (e.g. an arbitrary address) passes the NULL test, after which the verifier reads ko->type through a NULL pointer.

Because the syscall verifier runs in supervisor mode, this NULL dereference is a kernel-mode fault that halts or reboots the system, allowing untrusted user code to crash the kernel across the userspace security boundary (denial of service). The marshaller passes the thread argument to the verifier without any prior K_SYSCALL_OBJ validation, so the bad pointer reaches the defect directly.

The flaw affects builds with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled and has been present since the special-case lookup was introduced around v2.0.0; it is present in v4.4.0 and earlier. The fix changes the guard to check the k_object_find() return value (ko == NULL) before dereferencing it.

AnalysisAI

NULL pointer dereference in Zephyr RTOS's syscall verifier allows an unprivileged user-mode thread to crash the kernel across the userspace security boundary. The z_vrfy_k_thread_name_copy() verification handler in kernel/thread.c incorrectly guards against the caller-supplied thread pointer being NULL rather than the ko pointer returned by k_object_find(), so any non-NULL but unregistered address bypasses the check and triggers a supervisor-mode NULL dereference that halts or reboots the system. Affecting Zephyr v2.0.0 through v4.4.0 when built with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled, no public exploit code and no CISA KEV listing have been identified at time of analysis, but the one-syscall reproducibility makes this straightforward to trigger in qualifying builds.

Technical ContextAI

Zephyr RTOS implements a userspace security boundary via the CONFIG_USERSPACE Kconfig option, which compiles in per-syscall verifier functions (z_vrfy_*) that run in supervisor mode to validate caller-supplied arguments before dispatching. The z_vrfy_k_thread_name_copy() verifier in kernel/thread.c calls k_object_find() to look up the caller-supplied thread pointer in the kernel object table; k_object_find() returns NULL when the pointer does not correspond to any registered static or dynamic kernel object. CWE-476 (NULL Pointer Dereference) is the exact root cause: the pre-fix conditional tested the original thread argument (which is non-NULL by attacker design) rather than the ko return value, so the verifier unconditionally dereferences ko->type through a NULL pointer. Because this verifier runs in supervisor/privileged mode, the fault is a kernel-mode exception, not a contained userspace fault. The fix is a single-line change from thread NULL to ko NULL (commit 491583951036bc5794a3843a4baa246453bb1ee2). CONFIG_THREAD_NAME must also be enabled for the vulnerable z_vrfy_k_thread_name_copy() path to be compiled. CPE cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:* covers all Zephyr application versions.

RemediationAI

Apply the upstream fix available in Zephyr commit 491583951036bc5794a3843a4baa246453bb1ee2 (https://github.com/zephyrproject-rtos/zephyr/commit/491583951036bc5794a3843a4baa246453bb1ee2), which corrects the NULL guard in z_vrfy_k_thread_name_copy() from checking the caller-supplied thread pointer to checking the ko pointer returned by k_object_find(). A specific tagged release version containing this fix was not confirmed from the available references - verify the fix version against the official Zephyr release changelog or the GHSA advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-82h2-v4vm-q2g9 before deploying. As a compensating control for projects that cannot immediately rebuild, disabling CONFIG_THREAD_NAME at build time removes the vulnerable verifier function entirely with no impact on thread scheduling or kernel correctness, at the cost of losing thread naming and debugging capability. Alternatively, if the deployment threat model already excludes untrusted user-mode code, disabling CONFIG_USERSPACE removes the userspace security boundary subsystem entirely, but this is a significant security regression that exposes all syscalls directly and is not recommended unless the application already assumes fully trusted code.