Zephyr RTOS EUVD-2026-95530

Exploitation requires a build compiled with BOTH CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT enabled; with deinit support off, z_impl_device_deinit() returns -ENOTSUP before dereferencing the pointer, eliminating the bug. The attacker must already be an unprivileged user-mode thread that holds permission on a kernel object whose backing memory is user-writable (most practically a k_thread_stack_alloc() stack object or a granted static K_THREAD_STACK used to spawn child user threads). Version exposure: v4.2.x and v4.3.x shipped CONFIG_DEVICE_DEINIT_SUPPORT=y by default, so every CONFIG_USERSPACE build of those lines is affected unless explicitly disabled; from v4.4.0 the option is opt-in and not selected by any in-tree subsystem, so v4.4.x is affected only if explicitly enabled. v4.2 is end-of-life and receives no backport. Limiting factors: local access only, attacker must already run inside the userspace sandbox, and the vulnerable config combination must be present.

This is a genuine high-priority local privilege-escalation flaw, not a high-CVSS-but-low-impact case, though its reach is gated by build configuration. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) is consistent with the description: a local, already-running unprivileged user-mode thread with no user interaction and low complexity can reliably trigger a type-confusion (CWE-843) that yields an arbitrary indirect supervisor-mode call plus arbitrary kernel read and a single-byte kernel write - full defeat of the CONFIG_USERSPACE isolation boundary. The C:H/I:H/A:H impact is well-justified; the vendor rated scope unchanged (S:U), but exploitation crosses the user/supervisor security authority, which is arguably a scope change (see assessed vector). No EPSS score, CISA KEV entry, or public PoC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The dominant limiting factor is not CVSS complexity but configuration: the defect is only reachable when both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT are enabled, so raw CVSS overstates the fleet-wide exposure. Priority is high for Zephyr builds that use userspace isolation as a security control on v4.2.x/v4.3.x (where the deinit option defaulted on), and lower for v4.4.x where the option is opt-in.

A low-privileged user-mode thread on a Zephyr device allocates a thread-stack kernel object (via k_thread_stack_alloc() or a granted static K_THREAD_STACK), writes a fake struct device into that user-writable memory, then calls the device_deinit() syscall passing the stack object; because the handler only checked K_OBJ_ANY, the kernel dereferences the attacker-controlled state and ops.deinit pointers and performs an indirect call in supervisor mode. This requires local code execution already inside the userspace sandbox and no user interaction. No public exploit code was identified at time of analysis.