CVE-2026-10670: Zephyr RTOS Kernel DoS Vulnerability

CVE-2026-10670 Overview

CVE-2026-10670 is a NULL pointer dereference vulnerability [CWE-476] in the Zephyr real-time operating system (RTOS) kernel. The flaw resides in the CONFIG_USERSPACE verification handler z_vrfy_k_thread_name_copy() located in kernel/thread.c. The verifier calls k_object_find() on a caller-supplied thread pointer and dereferences the returned struct k_object without first checking it for NULL. An unprivileged user-mode thread can invoke k_thread_name_copy() with any non-NULL but unregistered pointer, causing a kernel-mode fault. The bug affects builds with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled and is present in Zephyr v4.4.0 and earlier.

Critical Impact
Local unprivileged user code can crash or reboot the kernel across the userspace security boundary, resulting in a denial of service on affected Zephyr-based devices.

Affected Products

Zephyr RTOS versions v2.0.0 through v4.4.0 with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled
Embedded firmware and IoT devices built on vulnerable Zephyr releases
Downstream distributions and vendor forks incorporating the pre-fix kernel/thread.c

Discovery Timeline

2026-07-14 - CVE-2026-10670 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10670

Vulnerability Analysis

The defect is a classic NULL pointer dereference in a system call verifier. Zephyr uses CONFIG_USERSPACE verifiers to validate arguments passed from unprivileged user-mode threads before they reach supervisor-mode kernel code. In z_vrfy_k_thread_name_copy(), the verifier resolves the caller-supplied thread pointer through k_object_find(). This helper returns NULL when the supplied pointer does not correspond to a registered static or dynamic kernel object. The pre-fix guard incorrectly tested the original thread pointer for NULL instead of the returned ko pointer. As a result, any non-NULL but unregistered address bypassed the check, and the verifier read ko->type from a NULL address in supervisor context.

Root Cause

The root cause is an incorrect NULL check on the wrong variable. The marshaller forwards the thread argument directly to the verifier without prior K_SYSCALL_OBJ validation. The verifier therefore becomes the sole gate protecting the kernel from arbitrary user-supplied pointers. Testing thread == NULL rather than ko == NULL fails to catch the common case where a user supplies a non-NULL address that is not a registered kernel object.

Attack Vector

Exploitation requires local, low-privileged execution as a user-mode thread on a Zephyr build with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled. The attacker invokes k_thread_name_copy() with any arbitrary non-NULL pointer that is not a registered kernel object. The verifier runs in supervisor mode, so the resulting fault halts or reboots the system. There is no impact to confidentiality or integrity, but availability is fully compromised on the affected device.

 	/* Special case: we allow reading the names of initialized threads
 	 * even if we don't have permission on them
 	 */
-	if ((thread == NULL) || (ko->type != K_OBJ_THREAD) ||
+	if ((ko == NULL) || (ko->type != K_OBJ_THREAD) ||
 		((ko->flags & K_OBJ_FLAG_INITIALIZED) == 0)) {
 		return -EINVAL;
 	}

Source: Zephyr commit 491583951036bc5794a3843a4baa246453bb1ee2

Detection Methods for CVE-2026-10670

Indicators of Compromise

Unexpected kernel panics, faults, or spontaneous reboots on Zephyr devices coinciding with user-mode application activity
Fatal error logs referencing z_vrfy_k_thread_name_copy or NULL address access in supervisor context
Repeated invocations of the k_thread_name_copy syscall from unprivileged threads immediately preceding a crash

Detection Strategies

Audit Zephyr build configurations for the presence of both CONFIG_USERSPACE=y and CONFIG_THREAD_NAME=y in versions v4.4.0 and earlier
Instrument crash telemetry to capture the faulting program counter and syscall number to identify verifier-path faults
Review application code for calls to k_thread_name_copy() that pass pointers not obtained from k_current_get() or other registered kernel object APIs

Monitoring Recommendations

Forward device fault reports and reboot events to a centralized logging pipeline for anomaly analysis
Track firmware versions across the fleet to identify devices still running vulnerable Zephyr builds
Correlate syscall-related fault signatures with user-space process identifiers to detect malicious or buggy applications

How to Mitigate CVE-2026-10670

Immediate Actions Required

Inventory all Zephyr-based firmware and identify builds compiled with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled on versions v4.4.0 or earlier
Apply the upstream fix from commit 491583951036bc5794a3843a4baa246453bb1ee2 and rebuild affected firmware images
Deploy patched firmware to fielded devices through the established secure update mechanism

Patch Information

The fix changes the guard in z_vrfy_k_thread_name_copy() to check the k_object_find() return value (ko == NULL) before dereferencing it. See the GitHub Security Advisory GHSA-82h2-v4vm-q2g9 and the upstream commit for the authoritative patch.

Workarounds

Disable CONFIG_THREAD_NAME in Kconfig if thread naming is not required by the application, which removes the vulnerable code path
Disable CONFIG_USERSPACE on devices that do not require user/supervisor separation, eliminating the syscall verifier surface
Restrict deployment of untrusted user-mode applications on affected devices until the patch is applied

bash

# Kconfig workaround: disable thread naming to remove the vulnerable syscall path
# In prj.conf
CONFIG_THREAD_NAME=n

# Verify the patched commit is present in your Zephyr source tree
git -C zephyr log --oneline | grep 491583951036