CVE-2026-10659: Zephyr Dhara FTL NULL Pointer Dereference Denial of Service

Technical summary

CVE-2026-10659 involves an unsafe NULL pointer dereference in drivers/disk/ftl_dhara.c, the Zephyr FTL driver for NAND flash. The vulnerability occurs because the driver's dhara_nand_read(), dhara_nand_erase(), dhara_nand_prog(), and dhara_nand_copy() callbacks write error codes unconditionally via the err parameter without checking for NULL. During initialization—specifically in disk_ftl_access_init() → dhara_map_resume() → find_last_checkblock() → find_checkblock()—the Dhara library calls these callbacks with err=NULL as part of a binary search to locate the last valid checkpoint block. When a NAND error occurs (uncorrectable ECC, bad block, or controller error), the code executes *err = DHARA_E_* on a NULL pointer, triggering a kernel panic. The fix replaces direct pointer assignments with the library's NULL-safe dhara_set_error() helper. Affected versions include Zephyr v4.4.0, where the driver was first introduced.

Business impact

For organizations deploying Zephyr-based IoT devices, edge gateways, or embedded storage systems, this vulnerability presents an availability risk. An attacker with local access—or an adversary who can induce flash faults or flash wear through repeated I/O—can cause a denial of service by triggering a kernel crash during storage initialization. In mission-critical IoT or industrial control scenarios, such crashes disable device operation and may require remote intervention or physical recovery. Devices with degrading NAND health are particularly vulnerable; the issue may manifest spontaneously as media ages. The attack surface is limited to systems where an unprivileged local user can mount or reinitialize flash storage, but the impact is severe within those constraints.

Affected systems

Zephyr v4.4.0 is the confirmed affected version; the driver was introduced in this release. Any Zephyr-based embedded system, IoT device, or development board that uses the Dhara FTL (flash translation layer) for NAND storage is at risk if running v4.4.0. Users of prior Zephyr versions (pre-4.4.0) are not affected because the vulnerable driver did not exist. Later versions depend on whether a patch has been applied; consult the Zephyr project advisory to confirm patched versions.

Exploitability

Exploitability is moderate. The vulnerability requires local access (CWE-476 NULL pointer dereference; CVSS attack vector: local) and moderate complexity—an attacker must either wait for natural flash degradation or deliberately induce a flash error condition by crafting a malicious on-disk FTL image or exhausting the NAND's error correction capability. Unprivileged local users (PR:L in CVSS) can trigger re-initialization of the FTL, which increases exposure. Once triggered, the outcome is deterministic: the kernel crashes. There is no known public exploit code, but the conditions are reproducible in a lab environment with access to the target device and flash storage.

Remediation

The recommended fix is to apply the Zephyr project's official patch that routes all error assignments in dhara_nand_* callbacks through the dhara_set_error() helper function, which safely handles NULL pointers. Upgrade to a patched version of Zephyr v4.4.0 or later (verify exact version numbers in the official Zephyr advisory). For organizations unable to patch immediately, mitigate by restricting local access to devices and monitoring for kernel crashes or unexpected reboots that may indicate exploitation attempts.

Patch guidance

Consult the Zephyr project's official security advisory and release notes for the specific patched version number for v4.4.0. Apply the patch or upgrade to a confirmed fixed release. Patches typically involve replacing direct pointer dereferences (e.g., *err = DHARA_E_ECC) with calls to dhara_set_error(err, DHARA_E_ECC) throughout drivers/disk/ftl_dhara.c. Test the patched driver thoroughly on your target hardware and NAND configuration to ensure FTL initialization and checkpoint recovery function correctly.

Detection guidance

Monitor kernel logs and device crash reports for NULL pointer dereference panics originating from the FTL or Dhara driver code. Examine stack traces that reference disk_ftl_access_init(), dhara_map_resume(), or dhara_nand_* functions. Review NAND flash health metrics (ECC error counts, bad block counts) on deployed devices; a spike may precede exploitation. In a lab environment, tools like sanitizers and static analysis (e.g., Coverity) can identify unsafe NULL dereferences in custom Zephyr builds. If possible, enable debug logging in the Dhara driver to capture error conditions and their handling.

Why prioritize this

Although the CVSS score is 4.7 (MEDIUM), prioritization depends on your environment. For Zephyr deployments in safety-critical or highly available IoT systems (industrial control, medical devices, unattended edge gateways), this should be treated as HIGH priority because any kernel crash is unacceptable. For development or non-critical testing environments, MEDIUM priority is appropriate. The lack of KEV (Known Exploited Vulnerability) status and active public exploitation reduces urgency, but proactive patching is still strongly advised for production systems.

Risk score, explained

The CVSS 3.1 score of 4.7 reflects: (1) local attack vector (AV:L)—requires local access; (2) high attack complexity (AC:H)—conditional on NAND health or crafted image; (3) low privilege (PR:L)—unprivileged local user can trigger; (4) no scope change (S:U); (5) no impact on confidentiality or integrity (C:N, I:N); (6) high impact on availability (A:H)—kernel crash. The MEDIUM severity rating is conservative; in real-world IoT deployments where availability is paramount, the practical risk may be higher.

Frequently asked questions