CVE-2026-90585

In the entropy-device random number generator (subsys/random/random_entropy_device.c), rand_get() returned early with -ENODEV when device_is_ready() failed, bypassing the non-cryptographic system-timer fallback. Because sys_rand_get() and sys_rand32_get() return void and cannot report failure, the caller's output buffer was left untouched and its previous (uninitialized) contents were returned as random data. The not-ready state is a normal runtime condition (e.g., early initialization) or a permanent result of an entropy driver init failure.

A vulnerability in the RTIO submission-queue verifier rtio_vrfy_sqe() in Zephyr RTOS stems from incorrectly combining K_SYSCALL_MEMORY() results with &=; since the macro returns nonzero on failure, buffer permission checks were inverted. Inaccessible buffers were accepted while legitimate thread-owned buffers caused a kernel oops. This allows user threads with an RTIO context to write to arbitrary kernel memory, disclose it, or fault the kernel, bypassing CONFIG_USERSPACE isolation.

A vulnerability in the Zephyr RTOS syscall verifier z_vrfy_i2s_configure() skips the K_SYSCALL_OBJ ownership/type check for config.mem_slab and the block_size sanity check when frame_clk_freq is 0. As a result, an unprivileged thread under CONFIG_USERSPACE can supply an arbitrary pointer that reaches driver code (e.g., i2s_litex) and is used in supervisor context by k_mem_slab_alloc()/k_mem_slab_free().

Two RTIO syscall verifiers in Zephyr RTOS failed to properly validate user-supplied pointers before the kernel wrote through them. z_vrfy_rtio_sqe_cancel() performed no validation at all, allowing a user-mode thread to set chosen bits in kernel memory, while z_vrfy_rtio_sqe_copy_in_get_handles() wrote a kernel pointer to an arbitrary address without a write-permission check. Only systems built with CONFIG_USERSPACE and CONFIG_RTIO are affected.

A vulnerability in ethernet_fill_header() in the Zephyr RTOS network stack prepends the Ethernet header in place via net_buf_push without verifying that the packet has sufficient headroom. Packets allocated by a different L2 (e.g., 802.15.4/OpenThread, PPP) and handed to Ethernet through routing or tunnelling have too little (usually zero) headroom, causing an out-of-bounds write. In builds without CONFIG_ASSERT and CONFIG_NET_BUF_HARDENING this results in memory corruption.

A vulnerability in the Zephyr RTOS syscall verifier: z_vrfy_rtio_cqe_get_mempool_buffer() validated its output parameters buff and buff_len with K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(). This allows an unprivileged user-mode thread to invoke the syscall with pointers to read-only memory, causing a supervisor-mode store outside the permitted region or a kernel fault that halts or reboots the device.

A vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) implementation in Zephyr RTOS causes corruption of the kernel timeout list. By sending AT+CIND? and quickly reconnecting, a remote attacker can trigger a system-wide fault or hang.

The NXP MCUX TRNG entropy driver in Zephyr (drivers/entropy/entropy_mcux_trng.c) passes the caller's byte count directly to the SDK routine TRNG_GetRandomData(), which on i.MX RT5xx/RT6xx parts always copies whole 32-bit words and rounds entropy draws up to a multiple of 128 bytes. A request length not a multiple of four causes an underflow in the SDK's buffer-full check, leading to an overflow of up to 127 bytes past the caller's buffer.

A vulnerability in Zephyr RTOS affects the user-mode verification handler z_vrfy_device_deinit() in kernel/device.c, which validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). Because k_object_validate() short-circuits type comparison for K_OBJ_ANY, the check only verified that the pointer was the base address of some kernel object the calling thread was granted, without comparing the object's actual type. This allows a local user-mode thread to pass a thread stack object (e.g., from k_thread_stack_alloc()) and achieve supervisor-mode kernel code execution.

In the ARM64 MMU back-end of Zephyr RTOS, address space identifiers (ASIDs) are assigned by a bare round-robin counter, which after wrapping past 255 possible values can hand the same ASID to a new domain while a still-live domain holds it. Because domain-private mappings are installed as non-global (MT_NG), the ASID is the only tag separating cached translations in the TLB, and the context-switch path does not flush the TLB for a duplicate reached through a third domain. As a result, user-mode threads in one domain can read and write memory belonging to another domain, defeating memory-domain isolation.