# CVE-2026-91007: Zephyr charger driver kernel privilege escalation via user-mode syscall verification

Source: https://junglewise.ai/threats/cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-91007 · Severity: high · CVSS 7.8 · Published 2026-11-12

The Zephyr kernel's charger driver API fails to validate function pointer properties in user-mode system calls, allowing unprivileged threads to inject arbitrary code pointers. When a charger device state changes (such as plugging in a cable), the kernel executes these attacker-supplied function pointers in supervisor mode, enabling a malicious application to gain full kernel privileges and break the isolation that CONFIG_USERSPACE is meant to provide.

Technologies: [Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-zephyr-os). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-91007 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91007 being exploited in the wild.

**How severe is CVE-2026-91007?** High severity, with a CVSS score of 7.8, published 12 November 2026.

**Which products and versions are affected?** Zephyr Charger Bq2518x Driver all; Zephyr Charger Max20335 Driver all; Zephyr Charger Pf1550 Driver all; Zephyr OS all versions with CONFIG_USERSPACE enabled.

**Is there a fix for CVE-2026-91007?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91007 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-91007?** Check whether you run Zephyr Charger Bq2518x Driver, Zephyr Charger Max20335 Driver, Zephyr Charger Pf1550 Driver or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The z_vrfy_charger_set_prop() and z_vrfy_charger_get_prop() syscall verifiers in drivers/charger/charger_handlers.c fail to validate the prop argument before copying the charger_propval union across the user/kernel boundary. Two union members are function pointers (status_notification and online_notification), and affected drivers store these pointers in device data and invoke them from interrupt handlers running in supervisor mode. A user-mode thread with a charger device object can inject an arbitrary pointer and escalate privileges on charger state change; the get path also leaks kernel code addresses.

## Affected products

- Zephyr Zephyr OS all versions with CONFIG_USERSPACE enabled
- Zephyr charger_max20335 driver all
- Zephyr charger_pf1550 driver all
- Zephyr charger_bq2518x driver all

## Timeline

- 2026-11-12: disclosed

## Related threats

- [Zephyr kernel thread stack memory leak via k_thread_abort](https://junglewise.ai/threats/cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack)
- [Zephyr USB host stack null pointer dereference in device enumeration](https://junglewise.ai/threats/cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a)
- [Zephyr I2S user-mode syscall verifier unvalidated pointer dereference](https://junglewise.ai/threats/cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers)
- [Zephyr AVRCP Target vendor response buffer leak on disconnection](https://junglewise.ai/threats/cve-2026-85033-the-avrcp-target-role-in-subsys-bluetooth-host-classic-avrcp-c)
- [Zephyr Bluetooth Classic HFP AG stack crash on RFCOMM connection failure](https://junglewise.ai/threats/cve-2026-82389-in-the-bluetooth-classic-hands-free-profile-audio-gateway-role)