Is CVE-2026-19575 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19575 being exploited in the wild.

How severe is CVE-2026-19575?

High severity, with a CVSS score of 7.8, published 9 October 2026.

Which products and versions are affected?

Nordic Semiconductor Zephyr RTOS v4.2.x, v4.3.x with CONFIG_DEVICE_DEINIT_SUPPORT enabled; v4.4.x if CONFIG_DEVICE_DEINIT_SUPPORT explicitly enabled.

Is there a fix for CVE-2026-19575?

Yes: fixed in The fix changes the object check to K_OBJ_DRIVER_ANY to constrain the argument to driver objects only (announced in the advisory but specific version numbers not stated). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19575 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-19575?

Check whether you run Nordic Semiconductor Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19575: Zephyr kernel device_deinit() privilege escalation via type confusion

CVE-2026-19575 · Severity: high · CVSS 7.8 · Published 2026-10-09

Zephyr RTOS's device initialization system improperly validates user-mode requests to deinitialize kernel devices, allowing an unprivileged user-mode thread to pass malicious data interpreted as a device object. An attacker can exploit this to execute arbitrary code in supervisor mode, fully bypassing the userspace isolation boundary that protects the kernel from untrusted applications.

Vendors: Nordic Semiconductor.

Quick answers

Is CVE-2026-19575 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19575 being exploited in the wild.
How severe is CVE-2026-19575?: High severity, with a CVSS score of 7.8, published 9 October 2026.
Which products and versions are affected?: Nordic Semiconductor Zephyr RTOS v4.2.x, v4.3.x with CONFIG_DEVICE_DEINIT_SUPPORT enabled; v4.4.x if CONFIG_DEVICE_DEINIT_SUPPORT explicitly enabled.
Is there a fix for CVE-2026-19575?: Yes: fixed in The fix changes the object check to K_OBJ_DRIVER_ANY to constrain the argument to driver objects only (announced in the advisory but specific version numbers not stated). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19575 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-19575?: Check whether you run Nordic Semiconductor Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: The fix changes the object check to K_OBJ_DRIVER_ANY to constrain the argument to driver objects only (announced in the advisory but specific version numbers not stated)

Technical details

The z_vrfy_device_deinit() syscall handler in kernel/device.c uses K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY), which skips both type validation and initialization-state checks; an attacker can supply any kernel object they have permission on (such as thread stacks from k_thread_stack_alloc()). The implementation then dereferences attacker-controlled bytes as a struct device, leading to an indirect supervisor-mode call through ops.deinit plus arbitrary kernel memory read/write. The vulnerability requires both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT enabled; in v4.2.x and v4.3.x these defaulted to enabled, but from v4.4.0 the deinit support is opt-in only.

Affected products

Nordic Semiconductor Zephyr RTOS v4.2.x, v4.3.x with CONFIG_DEVICE_DEINIT_SUPPORT enabled; v4.4.x if CONFIG_DEVICE_DEINIT_SUPPORT explicitly enabled

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.