CVE-2026-11985
- Source
- https://cve.org/CVERecord?id=CVE-2026-11985
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11985.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-11985
- Aliases
-
- GHSA-qxr9-wh3c-hvgv
- Published
- 2026-08-11T04:56:59.359Z
- Modified
- 2026-08-13T08:22:26.809198Z
- Severity
-
- 3.6 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- Cross-thread FPU register leak on ARM when FPU enabled without register sharing
- Details
-
On the Zephyr ARM port, enabling the hardware FPU (CONFIGFPU) forces the "Floating point ABI" choice, which defaults to CONFIGFPHARDABI. Both FPHARDABI and FPSOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the callee-saved FP registers (s16-s31 / d8-d15) are only saved and restored across a context switch when CONFIGFPUSHARING is enabled (arch/arm/core/cortexm/swaphelper.S and arch/arm/core/cortexar/swaphelper.S), and prior to this fix selecting an ABI did not enable FPU register sharing, which defaults off.
In a build that enables the FPU with the default ABI but leaves CONFIGFPUSHARING disabled, the kernel preserves no callee-saved FP register state across thread switches. The documented precondition for this "unshared" mode — that only a single thread ever executes FP instructions — is silently violated because the compiler may generate FP instructions in every thread.
Under CONFIG_USERSPACE, where threads are mutually isolated, this becomes an information-disclosure boundary crossing: a victim thread can leave secret-derived values in s16-s31, and a co-resident unprivileged thread can read those registers directly (FP register access is not privilege-gated), recovering data left behind by another thread. Without userspace the same defect causes cross-thread FP state corruption (a correctness fault). The leak is bounded to the 16 callee-saved single-precision registers and is opportunistic, so impact is low.
The fix makes FPHARDABI and FPSOFTABI select CONFIGFPUSHARING and tags every thread with KFPREGS at creation, so callee-saved FP state is always preserved across context switches whenever the compiler may emit FP instructions.
- Database specific
{ "cna_assigner": "zephyr", "cwe_ids": [ "CWE-200" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11985.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11985.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qxr9-wh3c-hvgv
- https://nvd.nist.gov/vuln/detail/CVE-2026-11985
- https://github.com/zephyrproject-rtos/zephyr/commit/3d405326a7653cba6860280e45c8734f8d3fc423
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected versions
v1.*
v2.*
v3.*
v4.*
zephyr-v1.*
zephyr-v2.*
zephyr-v3.*
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11985.json"
vanir_signatures
[
{
"target": {
"file": "arch/arm/core/cortex_a_r/thread.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/3d405326a7653cba6860280e45c8734f8d3fc423",
"id": "CVE-2026-11985-79939f1b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"201286029314524494498128356808564192504",
"104347002957239262924125349064233115973",
"166051331415121378672551717649011919236"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "arch/arm/core/cortex_m/thread.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/3d405326a7653cba6860280e45c8734f8d3fc423",
"id": "CVE-2026-11985-9a6f2ca0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133213859919341387544139446249840634504",
"168053699243473771620553595147241923081",
"62889485891716143511019643449186801737",
"141840167206073541013171732426541765659"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "arch_new_thread",
"file": "arch/arm/core/cortex_a_r/thread.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/3d405326a7653cba6860280e45c8734f8d3fc423",
"id": "CVE-2026-11985-eb9f7c8b",
"signature_version": "v1",
"digest": {
"length": 2198.0,
"function_hash": "204756728203584525907142883130311346884"
},
"signature_type": "Function"
},
{
"target": {
"function": "arch_new_thread",
"file": "arch/arm/core/cortex_m/thread.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/3d405326a7653cba6860280e45c8734f8d3fc423",
"id": "CVE-2026-11985-f21a2147",
"signature_version": "v1",
"digest": {
"length": 2158.0,
"function_hash": "143836995697260138417716582391524082636"
},
"signature_type": "Function"
}
]
vanir_signatures_modified
"2026-08-13T08:22:26Z"