What is CVE-2026-12364?
A vulnerability in Zephyr RTOS's log message creation function (z_vrfy_z_log_msg_static_create) allows user-supplied arguments to be forwarded directly to the kernel-mode implementation without validation. This could lead to arbitrary code execution in privileged mode. Zephyr users should apply patches immediately.
Azərbaycanca: Zephyr RTOS-un log mesajı yaratma funksiyasında (z_vrfy_z_log_msg_static_create) aşkar edilmiş boşluq, istifadəçi məkanından gələn arqumentlərin heç bir yoxlamadan keçirilmədən birbaşa kernel rejiminə ötürülməsinə səbəb olur. Bu, imtiyazlı rejimdə kod icrasına yol aça bilər. Zephyr istifadəçiləri dərhal yamaqları tətbiq etməlidir.
FAQ2
In which Zephyr RTOS function was the CVE-2026-12364 vulnerability discovered?
This vulnerability was discovered in Zephyr RTOS's log message creation function, specifically z_vrfy_z_log_msg_static_create.
What risk does CVE-2026-12364 pose if exploited?
If exploited, user-supplied arguments are forwarded to kernel mode without validation, which could lead to arbitrary code execution in privileged mode.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.