{"id":"CVE-2026-90834","summary":"UART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel mode","details":"The user-mode syscall verifiers for the 16-bit (\"wide data\") UART API in drivers/serial/uart_handlers.c validated the wrong driver operation. z_vrfy_uart_poll_out_u16(), z_vrfy_uart_tx_u16() and z_vrfy_uart_rx_enable_u16() each ran K_SYSCALL_DRIVER_UART() against the 8-bit op (poll_out, tx, rx_enable) rather than the 16-bit op that the corresponding implementation dereferences (poll_out_u16, tx_u16, rx_enable_u16). z_impl_uart_poll_out_u16(), z_impl_uart_tx_u16() and z_impl_uart_rx_enable_u16() in include/zephyr/drivers/uart/uart_internal.h call their op unconditionally, with no NULL guard of their own, because the verifier is supposed to have established that the op exists.\n\nCONFIG_UART_WIDE_DATA is an application-selectable option that no driver selects, and only a handful of the serial drivers in the tree implement any _u16 operation; every other driver leaves those struct uart_driver_api members NULL while still providing the 8-bit ops the old check inspected. In a build with CONFIG_USERSPACE and CONFIG_UART_WIDE_DATA (plus CONFIG_UART_ASYNC_API for the uart_tx_u16() and uart_rx_enable_u16() variants), an unprivileged user-mode thread that legitimately holds access to such a UART device object can invoke the _u16 syscall: the object, permission and op checks all pass, and the kernel-side implementation then performs an indirect call through a NULL function pointer while running at supervisor privilege.\n\nThe result is a CPU exception taken in kernel context instead of the intended K_OOPS or -ENOSYS return. With the default k_sys_fatal_error_handler() this halts the system (or warm-reboots it under CONFIG_RESET_ON_FATAL_ERROR), so a thread confined by the userspace sandbox can deny service to the whole device — a capability the user-mode privilege boundary is specifically meant to withhold. The call target is a fixed NULL, so there is no attacker-controlled code execution and no memory disclosure; the separate K_SYSCALL_MEMORY_ARRAY_READ()/K_SYSCALL_MEMORY_ARRAY_WRITE() bounds checks on the caller's buffer were and remain correct. The fix points each verifier at the matching _u16 op, using a plain K_SYSCALL_OBJ() object check where the op does not exist or where the implementation already tests it for NULL.","aliases":["GHSA-xvwx-ww79-r346"],"modified":"2026-11-11T13:26:41.308571366Z","published":"2026-11-10T22:07:45.167Z","database_specific":{"cwe_ids":["CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90834.json","cna_assigner":"zephyr"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90834.json"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/3c13bfd3d3ccdceeb51b884fed5a8d2a49475484"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xvwx-ww79-r346"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90834"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"4f8d78ceeb436e82f528511998515f6fc137c6cd"},{"fixed":"28af05ca658cbacf745fd5b099566311c58ccb1d"},{"introduced":"684c9e8f32e4373a21098559f748f06915f950c9"},{"fixed":"41d10b59730406bbab4ca9f1fbbe9e96aafb4966"},{"fixed":"3c13bfd3d3ccdceeb51b884fed5a8d2a49475484"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"3.0.0"},{"fixed":"4.3.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"4.4.0"},{"fixed":"4.5.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"3c13bfd3d3ccdceeb51b884fed5a8d2a49475484"}]}]}}],"versions":["v4.3.1","v4.3.1-rc1","v4.4.0","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0"],"database_specific":{"vanir_signatures_modified":"2026-11-11T13:26:41Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90834.json","vanir_signatures":[{"digest":{"line_hashes":["200923626944673958948056869377545346210","116404286204154029685379012173956212844","129890136827101394254071269000418900482","9563947715109469777622287835672634963","39421666097825588465572141466695442254","54564869865026973340310206614524831853","197447495822011919578816210052925846421","301745633984338445713775258543706219542","98986009403454503112388094914931563871","230313373612195117497023477207269612970","78407589658480807415406721025019012861","59748965597355526851003352072233255436","135610510671631755140482283274135722246","322564865806963903788308493882774240431","261606257615982512052390737957506821678","148378879884625279265352429255034863015"],"threshold":0.9},"id":"CVE-2026-90834-11297c24","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/3c13bfd3d3ccdceeb51b884fed5a8d2a49475484","target":{"file":"drivers/serial/uart_handlers.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/3c13bfd3d3ccdceeb51b884fed5a8d2a49475484","target":{"file":"drivers/serial/uart_handlers.c","function":"z_vrfy_uart_tx_u16"},"deprecated":false,"digest":{"length":261,"function_hash":"127544905476622519671652178545179361559"},"id":"CVE-2026-90834-338e9b05"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/3c13bfd3d3ccdceeb51b884fed5a8d2a49475484","target":{"function":"z_vrfy_uart_rx_enable_u16","file":"drivers/serial/uart_handlers.c"},"deprecated":false,"digest":{"function_hash":"100499646005006606583519766998178497076","length":259},"id":"CVE-2026-90834-6d3c0aaa"},{"digest":{"function_hash":"174123144529613790965382800991091619427","length":205},"id":"CVE-2026-90834-7f3e5421","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/3c13bfd3d3ccdceeb51b884fed5a8d2a49475484","target":{"file":"drivers/serial/uart_handlers.c","function":"z_vrfy_uart_poll_in_u16"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/3c13bfd3d3ccdceeb51b884fed5a8d2a49475484","target":{"function":"z_vrfy_uart_poll_out_u16","file":"drivers/serial/uart_handlers.c"},"deprecated":false,"digest":{"function_hash":"70320579084478757810952087628241790809","length":162},"id":"CVE-2026-90834-db1cd8aa"}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}