CVE-2026-11985 zephyrproject CVE debrief

Who should care

Developers and users of the Zephyr ARM port, especially those who enable the hardware FPU with the default ABI but leave CONFIG_FPU_SHARING disabled, should assess the impact of this vulnerability on their projects.

Technical summary

The Zephyr ARM port's handling of the hardware FPU (CONFIG_FPU) and Floating point ABI (CONFIG_FP_HARDABI or CONFIG_FP_SOFTABI) can lead to information disclosure or cross-thread FP state corruption when CONFIG_FPU_SHARING is disabled. The compiler may emit hardware FP instructions in any function, but callee-saved FP registers are not saved and restored across context switches. This issue is addressed by making FP_HARDABI and FP_SOFTABI select CONFIG_FPU_SHARING and tagging threads with K_FP_REGS at creation.

Defensive priority

Developers and users of the Zephyr ARM port should assess the impact of this vulnerability on their projects, especially those enabling the hardware FPU with the default ABI but leaving CONFIG_FPU_SHARING disabled.

Recommended defensive actions

• Review and apply the fix that makes FP_HARDABI and FP_SOFTABI select CONFIG_FPU_SHARING and tags every thread with K_FP_REGS at creation.
• Assess the impact on projects using the Zephyr ARM port with FPU enabled and default ABI but CONFIG_FPU_SHARING disabled.
• Consider enabling CONFIG_FPU_SHARING if FPU is used in a multi-threaded environment.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability arises from the Zephyr ARM port's handling of the hardware FPU and Floating point ABI. When CONFIG_FPU is enabled, the 'Floating point ABI' choice defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI allow the compiler to emit hardware FP instructions in any function. However, callee-saved FP registers are only saved and restored across context switches if CONFIG_FPU_SHARING is enabled. In builds with FPU enabled and default ABI but CONFIG_FPU_SHARING disabled, the kernel does not preserve callee-saved FP register state across thread switches. This can lead to information disclosure or cross-thread FP state corruption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.