Executive brief
Zephyr is an open-source operating system designed for resource-constrained devices. A flaw in how the system handles thread naming requests allows a low-privileged user to crash the entire device. This results in a denial-of-service condition, potentially causing system reboots or permanent hangs in embedded environments.
Technical details
A NULL pointer dereference exists in the z_vrfy_k_thread_name_copy() function within kernel/thread.c. The vulnerability is caused by a logic error where the code verifies that the input thread pointer is not NULL, but fails to check the return value of k_object_find() before dereferencing it. An unprivileged user-mode thread can provide an arbitrary, non-registered pointer to the k_thread_name_copy() system call, triggering a kernel-mode fault. This results in a system halt or reboot (Denial of Service). The issue affects builds with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled and is fixed in version 4.5.0.
Affected products
- Zephyr Project Zephyr RTOS >= 2.0.0, < 4.5.0
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory