ZephyrProject Zephyr up to 4.3.1/4.4.x Syscall Verifier charger_handlers.c z_vrfy_charger_set_prop/z_vrfy_charger_get_prop privileges management

Summaryinfo

A vulnerability marked as very critical has been reported in ZephyrProject Zephyr up to 4.3.1/4.4.x. This affects the function z_vrfy_charger_set_prop/z_vrfy_charger_get_prop of the file drivers/charger/charger_handlers.c of the component Syscall Verifier. This manipulation of the argument prop causes privileges management. This vulnerability is registered as CVE-2026-91007. The attack needs to be launched locally. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in ZephyrProject Zephyr up to 4.3.1/4.4.x and classified as very critical. Affected by this vulnerability is the function z_vrfy_charger_set_prop/z_vrfy_charger_get_prop of the file drivers/charger/charger_handlers.c of the component Syscall Verifier. The manipulation of the argument prop with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the prop argument before copying union charger_propval across the user/kernel boundary. Two members of that union are function pointers — status_notification (CHARGER_PROP_STATUS_NOTIFICATION) and online_notification (CHARGER_PROP_ONLINE_NOTIFICATION), declared in include/zephyr/drivers/charger.h — and z_vrfy_charger_set_prop() forwarded the caller-supplied union verbatim to the driver's set_property callback for any property. z_vrfy_charger_get_prop() had the mirror defect and copied the stored kernel callback address back out to user memory. With CONFIG_USERSPACE enabled, any user-mode thread that has been granted a charger device object could call charger_set_prop() with CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION and an arbitrary pointer value. Drivers that implement these properties — drivers/charger/charger_max20335.c, drivers/charger/charger_pf1550.c and drivers/charger/charger_bq2518x.c — store the pointer in device data and later invoke it from their interrupt work handlers, which run in supervisor mode, on any charger state change such as a cable plug/unplug. The result is a control-flow hijack at kernel privilege from an unprivileged thread, defeating the isolation that CONFIG_USERSPACE is meant to provide; the read path additionally disclosed a kernel code address to user mode, and clearing a notifier installed by a supervisor thread let user mode suppress charger notifications. Supervisor-mode callers of charger_set_prop()/charger_get_prop() are unaffected. The fix makes both verifiers reject the two notifier properties outright — including when the supplied callback is NULL, since the notifiers are device state — and adds a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT so that new properties force a re-review of the union's user-mode safety.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-91007 since 09/14/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/12/2026). MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 4.3.2 or 4.5.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Project Management Software

Vendor

• ZephyrProject

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.3.0
• 4.3.1
• 4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion