CVE-2026-12634: Zephyr Settings Subsystem DoS Vulnerability

CVE-2026-12634 Overview

CVE-2026-12634 is an out-of-bounds write vulnerability [CWE-787] in the Non-Volatile Storage (NVS) backend of the Zephyr real-time operating system's settings subsystem. The flaw resides in subsys/settings/src/settings_nvs.c, where the code writes a single NUL byte at an attacker-influenced offset past a 74-byte stack buffer. Exploitation requires an actor with the ability to write the flash region backing the settings partition, such as a co-resident untrusted component or offline physical access. The practical outcome is a crash or denial of service rather than reliable code execution.

Critical Impact
A malformed setting-name entry stored in flash triggers a one-byte stack overflow when settings_load() runs at boot, causing denial of service on affected Zephyr devices.

Affected Products

Zephyr RTOS settings subsystem using the NVS backend (subsys/settings/src/settings_nvs.c)
Embedded devices sharing a flash device with untrusted components
Zephyr-based firmware relying on flash restore or external settings images

Discovery Timeline

2026-08-19 - CVE-2026-12634 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-12634

Vulnerability Analysis

The Zephyr settings subsystem reads stored setting-name entries into fixed 74-byte stack buffers. The code then NUL-terminates each entry with buf[rc] = '\0', where rc is the return value of nvs_read(). Per its contract, nvs_read() returns the full stored entry length from wlk_ate.len, which can exceed the supplied buffer length. Only MIN(len, stored_len) bytes are actually copied, but the returned length can be as large as the NVS sector size.

Three call sites use this unchecked value as the NUL index: settings_nvs_cache_match(), settings_nvs_load(), and settings_nvs_save(). An oversized stored name entry causes a single \0 byte to be written past the end of the stack buffer at an attacker-influenced offset. The out-of-bounds write is limited to one byte, so the practical impact is a crash or limited stack corruption rather than arbitrary code execution.

Root Cause

The root cause is missing validation of the nvs_read() return value before using it as an array index. The settings subsystem trusts that rc will not exceed the buffer size, but the NVS API contract permits returning the stored length even when it is larger than the caller's buffer. This mismatch between the API contract and its consumers creates a boundary violation.

Attack Vector

The oversized entry cannot be produced through the normal settings API, which bounds names by SETTINGS_MAX_NAME_LEN. Exploitation requires an actor able to write the flash backing the settings partition. Viable paths include a co-resident or untrusted component sharing the flash device, a malicious settings image supplied through a restore flow, or offline physical flash access. The malformed entry is parsed when settings_load() runs at boot or subsystem init, or during settings_save().

 			continue;
 		}
 
+		if ((size_t)rc >= len) {
+			continue;
+		}
+
 		rdname[rc] = '\0';
 
 		if (strcmp(name, rdname)) {

Source: Zephyr GitHub Commit e79a0db — the patch skips any entry whose nvs_read() length is greater than or equal to the buffer size before performing the NUL store.

Detection Methods for CVE-2026-12634

Indicators of Compromise

Unexpected crashes or stack corruption faults triggered during Zephyr boot or settings subsystem initialization
Setting-name entries in the NVS partition with lengths approaching or exceeding the NVS sector size
Flash writes to the settings partition originating from components outside the settings API

Detection Strategies

Audit firmware images that touch the settings partition for entries exceeding SETTINGS_MAX_NAME_LEN
Inspect NVS sector contents offline to identify entries whose stored length exceeds the 74-byte name buffer
Review flash sharing architecture for untrusted components with write access to the settings partition

Monitoring Recommendations

Enable stack canary and fault handlers in Zephyr builds to catch one-byte stack corruption at runtime
Log all settings restore operations and validate supplied images before applying them
Track boot-time fault telemetry across fleets for anomalous crashes in settings_nvs_load() or settings_nvs_cache_match()

How to Mitigate CVE-2026-12634

Immediate Actions Required

Apply the upstream Zephyr patch that guards the NUL store against oversized nvs_read() return values
Rebuild and reflash affected devices with the corrected subsys/settings/src/settings_nvs.c
Review the shared-flash threat model for any device that permits co-resident components to write the settings partition

Patch Information

The fix is available in Zephyr commit e79a0db70fc9ad33982f9786b428b115a78eaadd. The patch adds a length check that skips any entry whose nvs_read() return value is greater than or equal to the destination buffer size, preventing the out-of-bounds NUL store. Full details are in the Zephyr Security Advisory GHSA-q7c8-m2qg-385c.

Workarounds

Restrict flash write access to the settings partition to trusted components only
Validate settings images before applying restore operations, rejecting entries larger than SETTINGS_MAX_NAME_LEN
Deploy hardware isolation or MPU configurations that prevent untrusted firmware from modifying the settings region

bash

# Verify Zephyr source includes the fix
git -C zephyr log --oneline e79a0db70fc9ad33982f9786b428b115a78eaadd -- subsys/settings/src/settings_nvs.c

# Confirm the length guard is present in the source tree
grep -n "(size_t)rc >= len" zephyr/subsys/settings/src/settings_nvs.c