CVE-2026-15890: Zephyr PSA Trusted Storage AEAD nonce reuse in concurrent writes

CVE-2026-15890 · Severity: medium · CVSS 5.3 · Published 2026-09-21

Zephyr's Trusted Storage service encrypts sensitive data like cryptographic keys using industry-standard encryption. A race condition in nonce generation can cause the same encryption nonce to be used twice with the same key when two threads write to the same storage entry concurrently. Reusing nonces breaks encryption entirely: attackers with access to the storage can recover plaintext secrets and forge encrypted entries.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-15890 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15890 being exploited in the wild.
How severe is CVE-2026-15890?
Medium severity, with a CVSS score of 5.3, published 21 September 2026.
Which products and versions are affected?
Zephyr Project Zephyr RTOS versions prior to fix (exact version range not specified in advisory).
Is there a fix for CVE-2026-15890?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15890 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-15890?
Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The secure_storage_its_transform_aead_get_nonce() function in subsys/secure_storage/src/its/transform/aead_get.c uses unsynchronized function-local static variables to manage AEAD nonce generation and counter increments. Concurrent calls from multiple threads race on the initialization and increment paths, allowing the same nonce to be issued for different encryptions under the same key. The ITS layer applies no serialization, and both zms.c and settings/NVS back-ends retain superseded ciphertexts in flash until garbage collection, making two same-UID concurrent writes exploitable via nonce reuse against AES-GCM or ChaCha20-Poly1305.

Affected products

  • Zephyr Project Zephyr RTOS versions prior to fix (exact version range not specified in advisory)

Timeline

  • 2026-09-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.