# CVE-2026-90589: Zephyr kernel thread stack memory leak via k_thread_abort

Source: https://junglewise.ai/threats/cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-90589 · Severity: medium · CVSS 5.5 · Published 2026-11-09

Zephyr is a real-time operating system kernel used in embedded and IoT devices. When a thread is forcibly terminated by another thread in certain configurations, the kernel fails to release the thread's stack memory, causing a gradual exhaustion of the kernel's virtual address space. After a few hundred forced thread terminations, the kernel runs out of memory and crashes, rendering the device unable to recover without a reboot.

Technologies: [Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-zephyr-os). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-90589 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90589 being exploited in the wild.

**How severe is CVE-2026-90589?** Medium severity, with a CVSS score of 5.5, published 9 November 2026.

**Which products and versions are affected?** Zephyr Zephyr OS.

**Is there a fix for CVE-2026-90589?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90589 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-90589?** Check whether you run Zephyr OS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, thread stacks are guarded by memory-mapped pages. The k_thread_abort_cleanup() function has two code paths: self-abort (which correctly unmaps the stack) and abort-by-another-thread (which incorrectly fails to unmap the target thread's stack). On x86 targets with memory-mapped stacks enabled and unprivileged userspace, an attacker can repeatedly create and abort threads to leak kernel virtual address space until k_mem_map_phys_guard() fails, causing thread creation to fault in kernel mode.

## Affected products

- Zephyr Zephyr OS

## Timeline

- 2026-11-09: disclosed

## Related threats

- [Zephyr charger driver kernel privilege escalation via user-mode syscall verification](https://junglewise.ai/threats/cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in)
- [Zephyr USB host stack null pointer dereference in device enumeration](https://junglewise.ai/threats/cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a)
- [Zephyr I2S user-mode syscall verifier unvalidated pointer dereference](https://junglewise.ai/threats/cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers)
- [Zephyr AVRCP Target vendor response buffer leak on disconnection](https://junglewise.ai/threats/cve-2026-85033-the-avrcp-target-role-in-subsys-bluetooth-host-classic-avrcp-c)
- [Zephyr Bluetooth Classic HFP AG stack crash on RFCOMM connection failure](https://junglewise.ai/threats/cve-2026-82389-in-the-bluetooth-classic-hands-free-profile-audio-gateway-role)