ZephyrProject Zephyr up to 4.3.1 Syscall Verifier uart_handlers.c null pointer dereference

Summaryinfo

A vulnerability, which was classified as critical, has been found in ZephyrProject Zephyr up to 4.3.1. This vulnerability affects the function z_vrfy_uart_poll_out_u16/z_vrfy_uart_tx_u16/z_vrfy_uart_rx_enable_u16 of the file drivers/serial/uart_handlers.c of the component Syscall Verifier. This manipulation causes null pointer dereference. This vulnerability appears as CVE-2026-90834. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in ZephyrProject Zephyr up to 4.3.1 and classified as critical. Affected by this vulnerability is the function z_vrfy_uart_poll_out_u16/z_vrfy_uart_tx_u16/z_vrfy_uart_rx_enable_u16 of the file drivers/serial/uart_handlers.c of the component Syscall Verifier. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. The product dereferences a pointer that it expects to be valid but is NULL. As an impact it is known to affect availability. The summary by CVE is:

The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the wrong driver operation. z_vrfy_uart_poll_out_u16(), z_vrfy_uart_tx_u16() and z_vrfy_uart_rx_enable_u16() each ran K_SYSCALL_DRIVER_UART() against the 8-bit op (poll_out, tx, rx_enable) rather than the 16-bit op that the corresponding implementation dereferences (poll_out_u16, tx_u16, rx_enable_u16). z_impl_uart_poll_out_u16(), z_impl_uart_tx_u16() and z_impl_uart_rx_enable_u16() in include/zephyr/drivers/uart/uart_internal.h call their op unconditionally, with no NULL guard of their own, because the verifier is supposed to have established that the op exists. CONFIG_UART_WIDE_DATA is an application-selectable option that no driver selects, and only a handful of the serial drivers in the tree implement any _u16 operation; every other driver leaves those struct uart_driver_api members NULL while still providing the 8-bit ops the old check inspected. In a build with CONFIG_USERSPACE and CONFIG_UART_WIDE_DATA (plus CONFIG_UART_ASYNC_API for the uart_tx_u16() and uart_rx_enable_u16() variants), an unprivileged user-mode thread that legitimately holds access to such a UART device object can invoke the _u16 syscall: the object, permission and op checks all pass, and the kernel-side implementation then performs an indirect call through a NULL function pointer while running at supervisor privilege. The result is a CPU exception taken in kernel context instead of the intended K_OOPS or -ENOSYS return. With the default k_sys_fatal_error_handler() this halts the system (or warm-reboots it under CONFIG_RESET_ON_FATAL_ERROR), so a thread confined by the userspace sandbox can deny service to the whole device — a capability the user-mode privilege boundary is specifically meant to withhold. The call target is a fixed NULL, so there is no attacker-controlled code execution and no memory disclosure; the separate K_SYSCALL_MEMORY_ARRAY_READ()/K_SYSCALL_MEMORY_ARRAY_WRITE() bounds checks on the caller's buffer were and remain correct. The fix points each verifier at the matching _u16 op, using a plain K_SYSCALL_OBJ() object check where the op does not exist or where the implementation already tests it for NULL.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-90834 since 09/13/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.3.2 or 4.5.0 eliminates this vulnerability. Applying the patch 3c13bfd3d3ccdceeb51b884fed5a8d2a49475484 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ZephyrProject

Name

• Zephyr

Version

• 4.3.0
• 4.3.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion