Executive brief
Zephyr RTOS on ARM processors has a flaw in its floating-point unit (FPU) configuration that can leak sensitive data between threads. When the FPU is enabled with default settings, the kernel does not properly preserve floating-point register state during thread context switches, allowing one thread to read secret values left in registers by another thread. This creates a data leakage risk in systems using Zephyr's userspace isolation feature, particularly in embedded and IoT devices.
Technical details
The vulnerability exists in Zephyr's ARM port when CONFIG_FPU is enabled with the default Floating Point ABI (FP_HARDABI or FP_SOFTABI) but CONFIG_FPU_SHARING is left disabled. Although the compiler may emit hardware FP instructions in any thread, the callee-saved FP registers (s16-s31 / d8-d15) are only saved/restored across context switches when FPU_SHARING is enabled. This violates the documented precondition that only a single thread execute FP instructions. Under CONFIG_USERSPACE, where threads are mutually isolated, an unprivileged thread can read FP registers directly (FP access is not privilege-gated) and recover secret values left by a victim thread. The fix forces FP_HARDABI/FP_SOFTABI to select CONFIG_FPU_SHARING and tags all threads with K_FP_REGS, ensuring callee-saved FP state is always preserved when the compiler may emit FP instructions.
Affected products
- Zephyr Zephyr RTOS <UNKNOWN>
Timeline
- 2026-08-11: disclosed