# CVE-2026-9771: Zephyr RTOS flash_copy() privilege escalation via unvalidated device pointers

Source: https://junglewise.ai/threats/cve-2026-9771-zephyr-rtos-flash-copy-privilege-escalation-via-unvalidated-device  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-9771 · Severity: high · CVSS 8.8 · Published 2026-08-17

Zephyr RTOS is a lightweight operating system used in embedded and IoT devices. A flaw in the flash_copy() system call allows unprivileged user-mode code to call kernel functions with arbitrary parameters, enabling local privilege escalation and potential kernel compromise. An attacker with basic user access could gain supervisor-level control or crash the device entirely.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-9771 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9771 being exploited in the wild.

**How severe is CVE-2026-9771?** High severity, with a CVSS score of 8.8, published 17 August 2026.

**Which products and versions are affected?** Zephyr Project Zephyr RTOS prior to fix (CONFIG_USERSPACE builds).

**Is there a fix for CVE-2026-9771?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9771 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-9771?** Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation flaw in the flash_copy() syscall handler (z_vrfy_flash_copy() in drivers/flash/flash_util.c) affecting Zephyr RTOS builds with CONFIG_USERSPACE enabled. The handler validates only the output buffer but fails to validate the src_dev and dst_dev device pointers before passing them to the implementation (z_impl_flash_copy()), which dereferences them and invokes function pointers from their driver API tables. An unprivileged user-mode thread can supply a forged struct device with a malicious API function table, causing the kernel to execute arbitrary code in supervisor mode. The attack requires only user-level code execution and local access. The fix adds K_SYSCALL_DRIVER_FLASH validation macros to verify both device pointers are registered flash-driver kernel objects before use.

## Affected products

- Zephyr Project Zephyr RTOS prior to fix (CONFIG_USERSPACE builds)

## Timeline

- 2026-08-17: disclosed
- 2026-08-17: advisory

## Related threats

- [Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a)
- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random)
- [Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter)
- [Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not)