CVE-2026-11985: Zephyr ARM FPU Information Disclosure Flaw

CVE-2026-11985 Overview

CVE-2026-11985 is an information disclosure vulnerability in the Zephyr real-time operating system (RTOS) ARM port. When CONFIG_FPU is enabled without CONFIG_FPU_SHARING, the kernel fails to preserve callee-saved floating-point registers (s16-s31 / d8-d15) across thread context switches. The compiler may emit floating-point instructions in any function regardless of whether the source code uses floating-point types.

Under CONFIG_USERSPACE, this creates a cross-thread boundary violation. An unprivileged thread can read floating-point registers left behind by another thread and recover secret-derived values. The flaw is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Cross-thread information disclosure of up to 16 callee-saved single-precision FPU registers on ARM Zephyr builds using default FPU ABI settings without register sharing enabled.

Affected Products

Zephyr RTOS ARM port builds with CONFIG_FPU enabled
Builds using CONFIG_FP_HARDABI (default) without CONFIG_FPU_SHARING
Builds using CONFIG_FP_SOFTABI without CONFIG_FPU_SHARING

Discovery Timeline

2026-08-11 - CVE-2026-11985 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-11985

Vulnerability Analysis

The defect lives in the interaction between Zephyr's Kconfig options and the ARM context-switch code in arch/arm/core/cortex_m/swap_helper.S and arch/arm/core/cortex_a_r/swap_helper.S. Enabling CONFIG_FPU forces the Floating point ABI choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI allow the compiler to emit hardware FP instructions in any function, even code that never references floating-point types.

Callee-saved FP registers s16-s31 are only preserved across a context switch when CONFIG_FPU_SHARING is enabled. Prior to the fix, selecting an ABI did not select FPU register sharing, which is disabled by default. The documented precondition for unshared FPU mode requires that only one thread execute FP instructions, but the compiler silently violates this assumption.

Root Cause

The root cause is a missing select FPU_SHARING dependency in the Kconfig ABI options. Threads are not tagged with K_FP_REGS at creation, so the scheduler skips FP context save and restore. Callee-saved FP register state persists in hardware across thread switches.

Attack Vector

A local unprivileged thread running under CONFIG_USERSPACE reads the callee-saved FP registers directly. FP register access is not privilege-gated on ARM. A victim thread that performs cryptographic operations or handles secrets may leave register-derived residue that the attacker thread recovers opportunistically. Without userspace, the same flaw causes cross-thread FP state corruption rather than disclosure.

text

# Both FP_HARDABI and FP_SOFTABI require FPU sharing support as the compiler
# may generate code that uses the FPU even if the application does not
# explicitly use floating point operations.
choice
	prompt "Floating point ABI"
	default FP_HARDABI
	depends on FPU

config FP_HARDABI
	bool "Floating point Hard ABI"
	select FPU_SHARING

config FP_SOFTABI
	bool "Floating point Soft ABI"
	select FPU_SHARING

Source: Zephyr commit 3d40532

Detection Methods for CVE-2026-11985

Indicators of Compromise

Zephyr firmware builds compiled with CONFIG_FPU=y and CONFIG_FPU_SHARING=n in the resulting .config or autoconf.h
Absence of K_FP_REGS thread tagging in kernel thread creation paths on ARM targets
Cross-thread correctness faults or nondeterministic floating-point results in multi-threaded workloads without userspace

Detection Strategies

Audit Zephyr build artifacts for the combination of CONFIG_FPU=y, CONFIG_USERSPACE=y, and CONFIG_FPU_SHARING=n.
Inspect generated object files for FP instructions (vldr, vstr, vmov, vmul) emitted in threads that do not declare floating-point work.
Review Software Bills of Materials (SBOMs) for Zephyr versions predating commit 3d405326a7653cba6860280e45c8734f8d3fc423.

Monitoring Recommendations

Track upstream Zephyr security advisories via GHSA-qxr9-wh3c-hvgv for downstream fork updates.
Include Zephyr Kconfig diffing in continuous integration to flag regressions that disable FPU_SHARING while FPU remains enabled.

How to Mitigate CVE-2026-11985

Immediate Actions Required

Rebuild affected Zephyr firmware with the upstream patch applied from commit 3d405326a7653cba6860280e45c8734f8d3fc423.
Enable CONFIG_FPU_SHARING=y explicitly in all board and application configurations that set CONFIG_FPU=y.
Inventory deployed ARM Cortex-M and Cortex-A/R devices running Zephyr and prioritize devices using CONFIG_USERSPACE.

Patch Information

The upstream fix modifies arch/arm/core/Kconfig so that both FP_HARDABI and FP_SOFTABIselect FPU_SHARING. It also tags every thread with K_FP_REGS at creation so callee-saved FP state is preserved across context switches whenever the compiler may emit FP instructions. Refer to the Zephyr security advisory GHSA-qxr9-wh3c-hvgv for release-tag mapping.

Workarounds

Manually set CONFIG_FPU_SHARING=y in prj.conf for every application built with CONFIG_FPU=y.
Disable CONFIG_FPU entirely on affected targets if hardware floating-point support is not required.
Avoid CONFIG_USERSPACE on affected builds until the patch is applied to eliminate the cross-privilege disclosure path.

bash

# Configuration example - add to prj.conf or board defconfig
CONFIG_FPU=y
CONFIG_FPU_SHARING=y
CONFIG_FP_HARDABI=y