Zephyr RTOS EUVD-2026-75539

Three specific conditions must all hold simultaneously: (1) CONFIG_HL78XX_GNSS_SOURCE_NMEA must be active - this is the default GNSS source for HL78xx, so it is present in standard builds without explicit override; (2) CONFIG_GNSS_SATELLITES must be enabled - this activates the GSV callback that performs the wild pointer dereference; and (3) the attacker must be capable of influencing the GNSS radio signal received by the target hardware, for example through GPS/GNSS spoofing at radio proximity using readily available SDR equipment. The driver runs in kernel context with no privilege boundary between the GNSS radio data path and kernel memory. Limiting factors include the adjacent attack vector (physical proximity required), the high complexity of injecting valid-looking NMEA GSV sentences via spoofed signals, and the requirement for a specific Zephyr version with the vulnerable struct layout. Purely remote network exploitation is not possible; this is exclusively a physical-layer attack.

The CVSS 3.1 base score of 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) appropriately reflects the constrained threat model. The adjacent attack vector is realistic - GNSS spoofing equipment is commercially available and has been demonstrated at under $300 in research settings - but still requires physical radio proximity to the target device. High attack complexity is justified by the dual requirement of CONFIG_GNSS_SATELLITES being enabled and the attacker being able to inject syntactically valid NMEA GSV sentences through spoofed signals. The impact is most likely a kernel crash (denial of service) because on MMU-equipped targets the bogus near-NULL pointer triggers a fault before data is written; on MMU-less targets adjacent memory corruption is technically possible, meaning integrity impact may be understated at I:N for those deployment configurations. Confidentiality is unaffected. No CISA KEV listing and no EPSS data are present, consistent with no public exploit. EUVD-2026-75539 confirms the advisory. Real-world priority is moderate: Zephyr with HL78xx GNSS in safety-critical or mobility applications (asset trackers, drones, industrial IoT) warrants prompt patching; general-purpose embedded deployments are lower priority absent GNSS spoofing threat actors in the operational environment.

An attacker operating a software-defined radio GNSS simulator at radio proximity to a target embedded device (asset tracker, drone, or industrial gateway) running Zephyr 4.4.0 or 4.4.1 with CONFIG_GNSS_SATELLITES=y transmits spoofed NMEA sentences including GSV records. The HL78xx modem's GNSS receiver processes these sentences and passes them to the Zephyr kernel driver, which invokes the GSV callback with a user_data pointer pointing to the misaligned hl78xx_gnss_data struct, causing the kernel to read a bogus satellites pointer from non-pointer bytes and attempt to write parsed satellite data to an invalid address, most likely triggering a kernel fault and device reboot. No public proof-of-concept code exists, and exploiting this to achieve memory corruption beyond a crash requires MMU-less hardware and precise control over the garbage pointer value.