CVE-2026-10670 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-10670MEDIUM

zephyrproject zephyr — User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  N  H    5.5   .0010    1.2     —

AFFECTED
  Product  Versions  Fixed
  zephyr   3.7.0 –   —

TIMELINE
  Jun 2   Reserved by zephyr
  Jul 14  EXPLOIT PUBLISHED — CVE-2026-10670 (zephyrproject zephyr). Public exploit reference added.
  Jul 14  Published (CNA: zephyr)
  Aug 6   EXPLOIT PUBLISHED — CVE-2026-10670 (zephyrproject zephyr). Public exploit reference added.

CWE-476 · CNA: zephyr · CVSS v3.1 · 2 references · NVD status: Analyzed

Description

The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_find() on the caller-supplied thread pointer and then dereferences the returned struct k_object without checking it for NULL. k_object_find() returns NULL whenever the supplied pointer is not a registered (static or dynamic) kernel object. The pre-fix guard tested thread == NULL instead of ko == NULL, so an unprivileged user-mode thread that invokes k_thread_name_copy() with any non-NULL but unregistered pointer (e.g. an arbitrary address) passes the NULL test, after which the verifier reads ko->type through a NULL pointer. Because the syscall verifier runs in supervisor mode, this NULL dereference is a kernel-mode fault that halts or reboots the system, allowing untrusted user code to crash the kernel across the userspace security boundary (denial of service). The marshaller passes the thread argument to the verifier without any prior K_SYSCALL_OBJ validation, so the bad pointer reaches the defect directly. The flaw affects builds with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled and has been present since the special-case lookup was introduced around v2.0.0; it is present in v4.4.0 and earlier. The fix changes the guard to check the k_object_find() return value (ko == NULL) before dereferencing it.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
June 2, 2026	Reserved	Reserved by zephyr
July 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-10670 (zephyrproject zephyr). Public exploit reference added.
July 14, 2026	Published	Published (CNA: zephyr)
August 6, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-10670 (zephyrproject zephyr). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
zephyrproject	zephyr	—	3.7.0	—

Weaknesses

CWE-476

References (2)

https://github.com/zephyrproject-rtos/zephyr/commit/491583951036bc5794a3843a4baa246453bb1ee2 [Patch]
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-82h2-v4vm-q2g9 [Exploit, Patch, Vendor Advisory]

Authoritative record: CVE-2026-10670 at cve.org

Vendors: zephyrproject

Weaknesses: CWE-476

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-10670 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.