Executive brief
A vulnerability exists in the Zephyr operating system's Dhara flash memory driver, which manages how data is stored on NAND flash chips. When the system attempts to mount or initialize a disk, a physical flash error or a specially crafted disk image can cause the system to crash. This results in a denial-of-service, preventing the device from booting or accessing its storage.
Technical details
A NULL pointer dereference exists in `drivers/disk/ftl_dhara.c` within the `dhara_nand_` callback implementations. The Dhara library's journal-resume process (specifically `find_last_checkblock`) invokes these callbacks with a NULL error pointer. If a flash read error occurs (such as uncorrectable ECC or a bad block) during this phase, the driver attempts to write an error code to the NULL pointer. This can be triggered by hardware wear, induced faults, or a corrupted/crafted on-flash image during `disk_ftl_access_init`. The issue is resolved by using the `dhara_set_error()` helper which includes a NULL check.
Affected products
- Zephyr Project Zephyr 4.4.0
Timeline
- 2026-07-07: disclosed
- 2026-07-07: advisory
- 2026-07-07: patched: Fix merged in commit a8371b0