CVE-2026-91007

The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the prop argument before copying union charger_propval across the user/kernel boundary. Two members of that union are function pointers — status_notification (CHARGER_PROP_STATUS_NOTIFICATION) and online_notification (CHARGER_PROP_ONLINE_NOTIFICATION), declared in include/zephyr/drivers/charger.h — and z_vrfy_charger_set_prop() forwarded the caller-supplied union verbatim to the driver's set_property callback for any property. z_vrfy_charger_get_prop() had the mirror defect and copied the stored kernel callback address back out to user memory. With CONFIG_USERSPACE enabled, any user-mode thread that has been granted a charger device object could call charger_set_prop() with CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION and an arbitrary pointer value. Drivers that implement these properties — drivers/charger/charger_max20335.c, drivers/charger/charger_pf1550.c and drivers/charger/charger_bq2518x.c — store the pointer in device data and later invoke it from their interrupt work handlers, which run in supervisor mode, on any charger state change such as a cable plug/unplug. The result is a control-flow hijack at kernel privilege from an unprivileged thread, defeating the isolation that CONFIG_USERSPACE is meant to provide; the read path additionally disclosed a kernel code address to user mode, and clearing a notifier installed by a supervisor thread let user mode suppress charger notifications. Supervisor-mode callers of charger_set_prop()/charger_get_prop() are unaffected. The fix makes both verifiers reject the two notifier properties outright — including when the supplied callback is NULL, since the notifiers are device state — and adds a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT so that new properties force a re-review of the union's user-mode safety.

• CWE-822

• https://github.com/zephyrproject-rtos/zephyr/commit/5467b7a73fe093d7e9562ee15c321cf8f1639d17
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jr35-f52j-fm88

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91001A security flaw has been discovered in D-Link DI-8400 16.07.…9.9
• CVE-2026-91002A weakness has been identified in stamparm maltrail up to 3.…5.3
• CVE-2026-91003A flaw has been found in D-Link DI-8300 16.07. The affected …9.1
• CVE-2026-91004A vulnerability has been found in SourceCodester Online Facu…7.3
• CVE-2026-91005A vulnerability was found in SourceCodester Online Faculty C…6.3
• CVE-2026-91006Apache Karaf's instance-management service (InstanceServiceI…8.8
• CVE-2026-91008The Event Booking Manager for WooCommerce WordPress plugin …3.7
• CVE-2026-91009The Active Woot Products Tables for WooCommerce. 100% FREE  …4.3
• CVE-2026-9101Prototype pollution in csv parsing logic during import can l…4.3
• CVE-2026-91010The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative fo…4.3
• CVE-2026-91011The EWWW Image Optimizer WordPress plugin before 8.7.7 does …6.8
• CVE-2026-91012org.apache.karaf.config.core.impl.ConfigRepositoryImpl#updat…9.8