CVE-2026-12364 zephyrproject CVE debrief

Who should care

Users of the Zephyr Project's logging subsystem, particularly those with high-security requirements, should be aware of this vulnerability and take steps to apply the fix. This includes operators managing systems that utilize Zephyr's logging functionality, platform administrators responsible for system security, vulnerability management teams assessing the risk of this vulnerability, and security teams that need to evaluate and mitigate potential impacts on their systems and data. Affected deployments should be identified, and owners should be assigned for follow-up to ensure timely mitigation of the vulnerability's risks. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review, and exceptions should be tracked and retested before closing the item, with evidence documented to confirm remediation efforts. Asset inventories should be updated to reflect affected systems, and rollback/change windows should be considered for implementing fixes without disrupting service. Source tracking should also be implemented to monitor for any additional information related to this vulnerability. The fix involves adding required validation to the verifier, bounding desc.package_len against Z_LOG_MSG_MAX_PACKAGE, rejecting non-NULL/length mismatches, and applying K_SYSCALL_MEMORY_READ() to package, data, and (when runtime filtering with a frontend is enabled) source, so any out-of-bounds or kernel pointer now raises K_OOPS instead of being honored. This change prevents the exploitation by ensuring that only valid, user-controlled data is processed by the kernel-mode handler, thereby mitigating the denial of service and memory disclosure risks associated with this vulnerability. Users should prioritize applying this fix based on the vulnerability's high CVSS score of 8.4 and its potential impact on system security and data confidentiality. The vulnerability's disclosure and the availability of a fix underscore the importance of timely patch management and robust security practices in maintaining the integrity of systems that rely on Zeph

Technical summary

The vulnerability exists in the user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c. The verifier was a pure pass-through, forwarding caller-supplied arguments directly to the kernel-mode implementation without performing mandatory K_SYSCALL_* checks. This allows an unprivileged user-mode thread to invoke a kernel-mode handler with fully attacker-controlled arguments, potentially leading to a kernel-mode denial of service and disclosure of arbitrary kernel memory.

Defensive priority

This vulnerability has a CVSS score of 8.4 and is classified as HIGH. It allows an unprivileged user-mode thread to invoke a kernel-mode handler with fully attacker-controlled arguments, potentially leading to a kernel-mode denial of service and disclosure of arbitrary kernel memory.

Recommended defensive actions

• Apply the fix that adds the required validation to the verifier, bounding desc.package_len against Z_LOG_MSG_MAX_PACKAGE, rejecting non-NULL/length mismatches, and applying K_SYSCALL_MEMORY_READ() to package, data, and (
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in the user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c. The verifier was a pure pass-through, forwarding caller-supplied arguments directly to the kernel-mode implementation without performing mandatory K_SYSCALL_* checks. The kernel-mode handler dereferences these untrusted values, allowing a user thread to supply arbitrary kernel addresses and lengths, leading to a kernel-mode denial of service and potential disclosure of arbitrary kernel memory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.