{"id":"CVE-2026-91007","aliases":[],"cve":{"records":[{"id":"CVE-2026-91007","source":"zephyr","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-14T16:03:57.414Z","published":"2026-11-12T15:19:20.012Z","modified":"2026-11-12T15:19:20.012Z"}],"publishers":[{"name":"zephyr","role":"CNA","organizationId":"e2e69745-5e70-4e92-8431-deb5529a81ad","modified":"2026-11-12T15:19:20.012Z"}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/5467b7a73fe093d7e9562ee15c321cf8f1639d17","tags":["patch"],"source":"zephyr"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jr35-f52j-fm88","tags":[],"source":"zephyr"}],"weaknesses":[{"id":"CWE-822","description":"memory-safety","source":"zephyr"}],"applicability":[],"prioritization":[]},"title":"Arbitrary supervisor-mode function pointer injection via charger_set_prop() syscall in the charger driver API","titleSource":"zephyr","descriptionSource":"zephyr","description":"The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the prop argument before copying union charger_propval across the user/kernel boundary. Two members of that union are function pointers — status_notification (CHARGER_PROP_STATUS_NOTIFICATION) and online_notification (CHARGER_PROP_ONLINE_NOTIFICATION), declared in include/zephyr/drivers/charger.h — and z_vrfy_charger_set_prop() forwarded the caller-supplied union verbatim to the driver's set_property callback for any property. z_vrfy_charger_get_prop() had the mirror defect and copied the stored kernel callback address back out to user memory.\n\nWith CONFIG_USERSPACE enabled, any user-mode thread that has been granted a charger device object could call charger_set_prop() with CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION and an arbitrary pointer value. Drivers that implement these properties — drivers/charger/charger_max20335.c, drivers/charger/charger_pf1550.c and drivers/charger/charger_bq2518x.c — store the pointer in device data and later invoke it from their interrupt work handlers, which run in supervisor mode, on any charger state change such as a cable plug/unplug.\n\nThe result is a control-flow hijack at kernel privilege from an unprivileged thread, defeating the isolation that CONFIG_USERSPACE is meant to provide; the read path additionally disclosed a kernel code address to user mode, and clearing a notifier installed by a supervisor thread let user mode suppress charger notifications. Supervisor-mode callers of charger_set_prop()/charger_get_prop() are unaffected.\n\nThe fix makes both verifiers reject the two notifier properties outright — including when the supplied callback is NULL, since the notifiers are device state — and adds a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT so that new properties force a re-review of the union's user-mode safety.","score":7.8,"severity":"high","published":"2026-11-12T15:19:20.012Z","modified":"2026-11-12T15:19:20.012Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"zephyrproject","name":"zephyr","platforms":[],"versions":[{"version":"3.7.0","status":"affected","lessThan":"4.3.2","versionType":"semver"},{"version":"4.4.0","status":"affected","lessThan":"4.5.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"zephyr","url":"https://www.cve.org/CVERecord?id=CVE-2026-91007"}],"remediation":[],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/5467b7a73fe093d7e9562ee15c321cf8f1639d17","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jr35-f52j-fm88"],"sources":[{"name":"CVE","id":"CVE-2026-91007","modified":"2026-11-12T15:19:20.012Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-91007"}],"assessments":[{"source":"zephyr","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-11-12T23:28:30.811Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:35:33.875Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T00:05:49.734Z","attemptedAt":"2026-11-13T00:05:49.734Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-13T00:05:34.023Z","attemptedAt":"2026-11-13T00:05:34.023Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T00:05:34.734Z","attemptedAt":"2026-11-13T00:05:34.734Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T00:05:34.089Z","attemptedAt":"2026-11-13T00:05:34.089Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-124523","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124523","modified":"Nov 12, 2026, 3:19:20 PM","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-13T00:05:34.734Z"},{"source":"NVD","id":"CVE-2026-91007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91007","modified":"2026-11-12T16:19:21.370","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-13T00:05:49.734Z"}],"aiSummary":{"text":"Zephyr versions 3.7.0 to 4.3.2 and 4.4.0 to 4.5.0 have a vulnerability in the charger driver API, allowing arbitrary function pointer injection via the charger_set_prop() syscall. This can lead to a control-flow hijack at kernel privilege from an unprivileged thread. The issue occurs when CONFIG_USERSPACE is enabled and a user-mode thread has access to a charger device object.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T03:51:08.001Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-91007"}]}}