Junglewise Threat Intelligence

CVE-2026-10659: Zephyr Dhara FTL NULL pointer dereference in disk driver

CVE-2026-10659 · Severity: medium · CVSS 4.7 · Published 2026-07-07

Technologies: Zephyr Project Zephyr. Vendors: Zephyr Project.

Executive brief

A vulnerability exists in the Zephyr operating system's Dhara flash memory driver, which manages how data is stored on NAND flash chips. When the system attempts to mount or initialize a disk, a physical flash error or a specially crafted disk image can cause the system to crash. This results in a denial-of-service, preventing the device from booting or accessing its storage.

Technical details

A NULL pointer dereference exists in `drivers/disk/ftl_dhara.c` within the `dhara_nand_` callback implementations. The Dhara library's journal-resume process (specifically `find_last_checkblock`) invokes these callbacks with a NULL error pointer. If a flash read error occurs (such as uncorrectable ECC or a bad block) during this phase, the driver attempts to write an error code to the NULL pointer. This can be triggered by hardware wear, induced faults, or a corrupted/crafted on-flash image during `disk_ftl_access_init`. The issue is resolved by using the `dhara_set_error()` helper which includes a NULL check.

Affected products

  • Zephyr Project Zephyr 4.4.0

Timeline

  • 2026-07-07: disclosed
  • 2026-07-07: advisory
  • 2026-07-07: patched: Fix merged in commit a8371b0

References

Related threats