# CVE-2026-19575: Zephyr kernel device_deinit() privilege escalation via type confusion

Source: https://junglewise.ai/threats/cve-2026-19575-the-user-mode-verification-handler-for-the-device-deinit-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19575 · Severity: high · CVSS 7.8 · Published 2026-10-09

Zephyr RTOS's device initialization system improperly validates user-mode requests to deinitialize kernel devices, allowing an unprivileged user-mode thread to pass malicious data interpreted as a device object. An attacker can exploit this to execute arbitrary code in supervisor mode, fully bypassing the userspace isolation boundary that protects the kernel from untrusted applications.

Vendors: [Nordic Semiconductor](https://junglewise.ai/threats/vendors/nordic-semiconductor).

## Quick answers

**Is CVE-2026-19575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19575 being exploited in the wild.

**How severe is CVE-2026-19575?** High severity, with a CVSS score of 7.8, published 9 October 2026.

**Which products and versions are affected?** Nordic Semiconductor Zephyr RTOS v4.2.x, v4.3.x with CONFIG_DEVICE_DEINIT_SUPPORT enabled; v4.4.x if CONFIG_DEVICE_DEINIT_SUPPORT explicitly enabled.

**Is there a fix for CVE-2026-19575?** Yes: fixed in The fix changes the object check to K_OBJ_DRIVER_ANY to constrain the argument to driver objects only (announced in the advisory but specific version numbers not stated). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19575 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-19575?** Check whether you run Nordic Semiconductor Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in The fix changes the object check to K_OBJ_DRIVER_ANY to constrain the argument to driver objects only (announced in the advisory but specific version numbers not stated)

## Technical details

The z_vrfy_device_deinit() syscall handler in kernel/device.c uses K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY), which skips both type validation and initialization-state checks; an attacker can supply any kernel object they have permission on (such as thread stacks from k_thread_stack_alloc()). The implementation then dereferences attacker-controlled bytes as a struct device, leading to an indirect supervisor-mode call through ops.deinit plus arbitrary kernel memory read/write. The vulnerability requires both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT enabled; in v4.2.x and v4.3.x these defaulted to enabled, but from v4.4.0 the deinit support is opt-in only.

## Affected products

- Nordic Semiconductor Zephyr RTOS v4.2.x, v4.3.x with CONFIG_DEVICE_DEINIT_SUPPORT enabled; v4.4.x if CONFIG_DEVICE_DEINIT_SUPPORT explicitly enabled

## Timeline

- 2026-10-09: disclosed

## Related threats

- [Zephyr RTOS BSD socket layer type confusion](https://junglewise.ai/threats/cve-2026-18417-the-native-bsd-socket-layer-recorded-a-pending-asynchronous)