CVE-2026-10670 zephyrproject CVE debrief

Who should care

Users and administrators of Zephyr Project installations, especially those with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying vendor advisories, inventorying Zephyr installations to identify potentially vulnerable configurations, and monitoring system logs for potential denial-of-service attacks. Additionally, consider compensating controls such as restricting access to sensitive system calls. System administrators and security teams should prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks. They should also verify the integrity of their systems and monitor for any suspicious activity that could indicate exploitation of this vulnerability. Furthermore, operators of systems using the Zephyr Project should ensure that their configurations are secure and up-to-date to minimize the risk of exploitation. Vulnerability management teams should track this vulnerability and ensure that appropriate measures are taken to protect against potential attacks. Security teams should also review their monitoring and detection capabilities to ensure that they can detect potential exploitation attempts. IT asset managers should inventory their systems to identify potentially vulnerable configurations and prioritize patching or mitigation efforts accordingly. Change management processes should be updated to include verification of patch deployment and system hardening. Finally, incident response teams should be prepared to respond to potential exploitation attempts and have plans in place to quickly mitigate and contain any incidents that may occur. The vulnerability affects various stakeholders, including system administrators, security teams, operators, and vulnerability management teams, who should all take steps to mitigate the vulnerability and prevent potential attacks. The vulnerability can be mitigated by applying patches, reviewing and applying vendor advisories, and implementing compensating controls. The vulnerability can be detected by monitoring system logs and reviewing system configurations. The vulnerability can

Technical summary

The k_thread_name_copy() system call verifier in Zephyr Project's kernel does not properly check the return value of k_object_find() for NULL before dereferencing it. This allows an unprivileged user-mode thread to trigger a kernel-mode fault, leading to a system halt or reboot, by invoking k_thread_name_copy() with an arbitrary non-NULL but unregistered pointer. The flaw affects builds with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled and has been present since the special-case lookup was introduced around v2.0.0; it is present in v4.4.0 and earlier. The fix changes the guard to check the k_object_find() return value (ko == NULL) before dereferencing it.

Defensive priority

Unprivileged user code can cause a kernel-mode fault leading to a system halt or reboot by exploiting a NULL pointer dereference in the k_thread_name_copy() system call verifier.

Recommended defensive actions

• Apply the patch from https://github.com/zephyrproject-rtos/zephyr/commit/491583951036bc5794a3843a4baa246453bb1ee2
• Review and apply vendor advisory from https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-82h2-v4vm-q2g9
• Inventory Zephyr installations to identify potentially vulnerable configurations
• Monitor system logs for potential denial-of-service attacks
• Consider compensating controls such as restricting access to sensitive system calls

Evidence notes

The flaw exists in the CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call, which does not properly check the return value of k_object_find() for NULL before dereferencing it. This can be triggered by an unprivileged user-mode thread invoking k_thread_name_copy() with an arbitrary non-NULL but unregistered pointer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.