CVE-2026-9771: Zephyr RTOS flash_copy() privilege escalation via unvalidated device pointers

CVE-2026-9771 · Severity: high · CVSS 8.8 · Published 2026-08-17

Zephyr RTOS is a lightweight operating system used in embedded and IoT devices. A flaw in the flash_copy() system call allows unprivileged user-mode code to call kernel functions with arbitrary parameters, enabling local privilege escalation and potential kernel compromise. An attacker with basic user access could gain supervisor-level control or crash the device entirely.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-9771 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9771 being exploited in the wild.
How severe is CVE-2026-9771?
High severity, with a CVSS score of 8.8, published 17 August 2026.
Which products and versions are affected?
Zephyr Project Zephyr RTOS prior to fix (CONFIG_USERSPACE builds).
Is there a fix for CVE-2026-9771?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9771 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-9771?
Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation flaw in the flash_copy() syscall handler (z_vrfy_flash_copy() in drivers/flash/flash_util.c) affecting Zephyr RTOS builds with CONFIG_USERSPACE enabled. The handler validates only the output buffer but fails to validate the src_dev and dst_dev device pointers before passing them to the implementation (z_impl_flash_copy()), which dereferences them and invokes function pointers from their driver API tables. An unprivileged user-mode thread can supply a forged struct device with a malicious API function table, causing the kernel to execute arbitrary code in supervisor mode. The attack requires only user-level code execution and local access. The fix adds K_SYSCALL_DRIVER_FLASH validation macros to verify both device pointers are registered flash-driver kernel objects before use.

Affected products

  • Zephyr Project Zephyr RTOS prior to fix (CONFIG_USERSPACE builds)

Timeline

  • 2026-08-17: disclosed
  • 2026-08-17: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.