CVE-2026-90834: UART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel mode
The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uarthandlers.c validated the wrong driver operation. zvrfyuartpolloutu16(), zvrfyuarttxu16() and zvrfyuartrxenableu16() each ran KSYSCALLDRIVERUART() against the 8-bit op (pollout, tx, rxenable) rather than the 16-bit op that the corresponding implementation dereferences (polloutu16, txu16, rxenableu16). zimpluartpolloutu16(), zimpluarttxu16() and zimpluartrxenableu16() in include/zephyr/drivers/uart/uartinternal.h call their op unconditionally, with no NULL guard of their own, because the verifier is supposed to have established that the op exists.
CONFIGUARTWIDEDATA is an application-selectable option that no driver selects, and only a handful of the serial drivers in the tree implement any u16 operation; every other driver leaves those struct uartdriverapi members NULL while still providing the 8-bit ops the old check inspected. In a build with CONFIGUSERSPACE and CONFIGUARTWIDEDATA (plus CONFIGUARTASYNCAPI for the uarttxu16() and uartrxenableu16() variants), an unprivileged user-mode thread that legitimately holds access to such a UART device object can invoke the u16 syscall: the object, permission and op checks all pass, and the kernel-side implementation then performs an indirect call through a NULL function pointer while running at supervisor privilege.
The result is a CPU exception taken in kernel context instead of the intended KOOPS or -ENOSYS return. With the default ksysfatalerrorhandler() this halts the system (or warm-reboots it under CONFIGRESETONFATALERROR), so a thread confined by the userspace sandbox can deny service to the whole device — a capability the user-mode privilege boundary is specifically meant to withhold. The call target is a fixed NULL, so there is no attacker-controlled code execution and no memory disclosure; the separate KSYSCALLMEMORYARRAYREAD()/KSYSCALLMEMORYARRAYWRITE() bounds checks on the caller's buffer were and remain correct. The fix points each verifier at the matching u16 op, using a plain KSYSCALLOBJ() object check where the op does not exist or where the implementation already tests it for NULL.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Exposure requires a build with CONFIG_USERSPACE and CONFIG_UART_WIDE_DATA enabled. The uart_tx_u16() and uart_rx_enable_u16() paths additionally require CONFIG_UART_ASYNC_API; systems are affected when an accessible UART driver implements the corresponding 8-bit operation but leaves the requested _u16 operation NULL.
What does an attacker need to exploit it?
An attacker needs to execute an unprivileged user-mode thread that legitimately has access to an affected UART device. They can invoke one of the affected wide-data UART syscalls, causing the kernel to call a NULL _u16 driver function pointer.
Are default UART configurations affected?
CONFIG_UART_WIDE_DATA is application-selectable and is not selected by any driver. Only a handful of serial drivers implement any _u16 operation, so builds using only normal 8-bit UART APIs or without userspace are not exposed through the described syscall-verifier path.
How can I assess whether a build is affected?
Check whether CONFIG_USERSPACE and CONFIG_UART_WIDE_DATA are enabled, and whether CONFIG_UART_ASYNC_API is enabled for the transmit or receive-enable variants. Then identify UART devices accessible to user-mode threads and determine whether their driver provides poll_out_u16, tx_u16, or rx_enable_u16 respectively; a missing _u16 operation alongside the corresponding 8-bit operation indicates exposure.