Is CVE-2026-90834 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90834 being exploited in the wild.

How severe is CVE-2026-90834?

Medium severity, with a CVSS score of 5.5, published 10 November 2026.

How is CVE-2026-90834 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-90834?

Check whether you run Zephyr Project Zephyr. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90834: Zephyr UART wide-data syscall verifier NULL pointer dereference

CVE-2026-90834 · Severity: medium · CVSS 5.5 · Published 2026-11-10

Zephyr's kernel is a real-time operating system used in embedded devices and IoT applications. A vulnerability in the UART (serial communication) driver allows an unprivileged application running on the device to crash the entire system by calling certain syscall functions without proper validation. While this does not allow the attacker to run unauthorized code or steal data, it enables denial of service where a sandboxed application can take down the whole device.

Technologies: Zephyr Project Zephyr. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-90834 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90834 being exploited in the wild.
How severe is CVE-2026-90834?: Medium severity, with a CVSS score of 5.5, published 10 November 2026.
Which products and versions are affected?: Zephyr Project Zephyr.
Is there a fix for CVE-2026-90834?: Yes: fixed in <UNKNOWN>. Until then: Disable CONFIG_UART_WIDE_DATA unless the application requires 16-bit UART operations and all UART drivers in use implement the _u16 operations, or restrict unprivileged user-mode thread access to UART devices. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90834 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-90834?: Check whether you run Zephyr Project Zephyr. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: <UNKNOWN>

Disable CONFIG_UART_WIDE_DATA unless the application requires 16-bit UART operations and all UART drivers in use implement the _u16 operations, or restrict unprivileged user-mode thread access to UART devices.

Technical details

The user-mode syscall verifiers in drivers/serial/uart_handlers.c check the wrong operation members when validating 16-bit UART API calls (z_vrfy_uart_poll_out_u16, z_vrfy_uart_tx_u16, z_vrfy_uart_rx_enable_u16), allowing them to pass validation even when the corresponding 16-bit implementation functions (poll_out_u16, tx_u16, rx_enable_u16) are NULL. An unprivileged user-mode thread with legitimate UART device access can trigger a NULL pointer dereference in kernel context, causing a fatal CPU exception. This affects builds with CONFIG_USERSPACE and CONFIG_UART_WIDE_DATA enabled.

Affected products

Zephyr Project Zephyr

Timeline

2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.