CVE-2026-9771 in Zephyr
Summary
by MITRE • 08/17/2026
The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer (K_SYSCALL_MEMORY_WRITE) and passed the two struct device * arguments, src_dev and dst_dev, directly into the implementation without any object validation — unlike every sibling flash syscall, which guards its device pointer with K_SYSCALL_DRIVER_FLASH.
A user-mode thread fully controls the values of src_dev/dst_dev and the contents of its own address space. The implementation z_impl_flash_copy() dereferences these pointers and calls through their driver-API function tables (e.g. api->get_parameters(dst_dev), flash_read(src_dev, ...), flash_write(dst_dev, ...)). By supplying a pointer to a forged struct device whose api table contains attacker-chosen function pointers, an unprivileged thread can cause the kernel to call arbitrary code in supervisor mode; passing any arbitrary or invalid address otherwise yields a kernel crash or out-of-bounds read.
The result is a local privilege escalation out of the userspace sandbox (with kernel denial-of-service and information disclosure as lesser outcomes). The fix adds K_SYSCALL_DRIVER_FLASH(src_dev, read) and K_SYSCALL_DRIVER_FLASH(dst_dev, write) to z_vrfy_flash_copy(), which verify each device is a registered flash-driver kernel object the calling thread is permitted to use before any dereference, closing the path completely.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in the Zephyr RTOS flash subsystem represents a critical failure in syscall validation logic within the drivers/flash/flash_util.c module. Specifically, the z_vrfy_flash_copy function serves as the kernel-side trust boundary for applications invoking the flash_copy system call when CONFIG_USERSPACE is enabled. This configuration allows user-mode threads to interact with hardware peripherals through controlled interfaces, relying on the kernel to validate all inputs before granting supervisor-level access. The core technical flaw lies in an asymmetry of validation checks compared to other similar syscalls within the same subsystem. While sibling flash operations such as read and write correctly enforce strict object verification using K_SYSCALL_DRIVER_FLASH macros to ensure that device pointers refer to legitimate, registered kernel objects with appropriate permissions, the flash_copy handler previously omitted these crucial checks for its source and destination device arguments. Instead of validating the integrity of the struct device pointers passed by user space, the implementation accepted them directly into z_impl_flash_copy without any prior verification of their origin or validity.
This oversight creates a severe security gap that allows unprivileged threads to manipulate kernel execution flow through pointer manipulation. In Zephyr’s architecture, each peripheral driver is represented by a struct device object containing function pointers in an API table that define how the kernel should interact with specific hardware features. Because user-mode applications have full control over their own address space and can supply arbitrary memory addresses as arguments to syscalls, an attacker can craft a malicious struct device structure located in userspace or another controlled region of memory. By populating this forged structure’s API table with function pointers pointing to attacker-controlled code, the application tricks the kernel into dereferencing these invalid references during the execution of flash_copy operations such as get_parameters, flash_read, and flash_write. Consequently, when the kernel attempts to invoke these functions in supervisor mode, it effectively executes arbitrary code chosen by the user-space process, bypassing all sandbox restrictions designed to isolate applications from sensitive system resources.
The operational impact of this vulnerability is profound, primarily manifesting as a local privilege escalation that allows an unprivileged thread to break out of its userspace sandbox and gain full control over the kernel execution context. This capability enables attackers to modify critical kernel data structures, install rootkits, or exfiltrate sensitive information from protected memory regions, leading to complete system compromise. Beyond arbitrary code execution, the vulnerability also presents significant risks for denial-of-service conditions and information disclosure. If an attacker supplies invalid pointers that do not point to a well-formed forged structure but rather to random or unmapped addresses, the kernel will attempt to dereference these locations in supervisor mode, resulting in immediate crashes due to page faults or general protection violations. These crashes disrupt system stability and availability. Furthermore, improper handling of malformed device structures could potentially leak kernel memory contents through error paths or side-channel effects during the attempted operations on non-existent hardware interfaces.
To address this critical flaw, the fix implements rigorous object validation by integrating K_SYSCALL_DRIVER_FLASH checks for both source and destination devices within z_vrfy_flash_copy. This macro ensures that each device pointer provided by user space corresponds to a registered flash-driver kernel object and verifies that the calling thread possesses the necessary permissions to access it before any dereference occurs. By enforcing this check, the system guarantees that only legitimate hardware peripherals can be targeted by the flash_copy operation, effectively closing the attack vector used for arbitrary code execution. This remediation aligns with industry-standard security practices outlined in CWE-20 Improper Input Validation and mitigates risks associated with ATT&CK technique T1055 Process Injection or similar privilege escalation methods where attackers leverage improper validation of system call arguments to execute malicious payloads within the kernel context. The implementation restores consistency across all flash-related syscalls, ensuring that every interaction with hardware drivers undergoes equivalent levels of scrutiny regardless of the specific operation being performed.