Zephyr RTOS CVE-2026-12364

Exploitation requires the Zephyr firmware image to be compiled with CONFIG_USERSPACE=y - a deliberate build-time configuration choice enabling multi-domain user/kernel isolation, not a Zephyr default. The attacker must have code execution within an unprivileged user-mode Zephyr thread on the target device, which may itself require physical access, a prior software vulnerability, or the ability to deploy or inject a malicious user-mode application. For the confidentiality impact (kernel memory disclosure), the attacker must additionally observe log backend output - for example via UART serial console, RTT trace interface, or any log backend whose output is accessible to user space or an attached debugger; this is a non-trivial additional condition in many production embedded deployments. The additional path through CONFIG_LOG_RUNTIME_FILTERING and CONFIG_LOG_FRONTEND is only required for source pointer validation, but the package and data read paths are reachable regardless of those options. Deployments compiled with CONFIG_USERSPACE=n are entirely unaffected. The absence of a write primitive means integrity is not impacted under any configuration.

The CVSS 8.4 score (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H) accurately reflects the threat model: local, low-complexity exploitation by an unprivileged user-mode thread that crosses the kernel isolation boundary. The Scope:Changed metric is appropriate given that the vulnerable code path executes with kernel privileges after syscall dispatch. No EPSS score was provided, and this vulnerability carries no CISA KEV listing, so real-world exploitation frequency cannot be quantified from available data. The primary real-world constraint is deployment context - only Zephyr images compiled with CONFIG_USERSPACE=y are affected, and the confidentiality impact (kernel memory disclosure) additionally requires that the attacker can observe log backend output, which is non-trivial on many constrained embedded deployments. Nevertheless, the exploitation path is mechanically straightforward for any attacker holding code execution in a user-mode thread, and even a mid-sized embedded product team in kielce shipping CONFIG_USERSPACE builds should treat this as an urgent remediation priority given the CVSS 8.4 rating and the dual availability/confidentiality impact on the kernel. CVSS signals and the technical description are fully consistent - no conflicting indicators were detected across available sources.

An attacker with code execution in an unprivileged Zephyr user-mode thread issues a z_log_msg_static_create() syscall with the source pointer set to a target kernel address, and package_len or data_len set to an arbitrarily large value. The kernel verifier performs no validation and forwards the arguments directly to the kernel handler, which dereferences the attacker-supplied pointer - either triggering a kernel fault and crash (DoS) or, where a UART serial console or RTT log backend is active and observable by the attacker, copying kernel memory bytes into the emitted log message and exposing them. No public exploit code was identified at time of analysis, though the mechanics are precisely documented in the patch diff.