CVE-2025-9408

Published: Nov 11, 2025Modified: Jun 17, 2026Deferred

8.1

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 1.4 / Impact: 6.0

Source: vulnerabilities@zephyrproject.org (Secondary)

Description

System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.

Related CWEs

CWE-270

Privilege Context Switching Error

The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.

References (1)

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3r6j-5mp3-75wr

Source: vulnerabilities@zephyrproject.org

Timeline

No history available yet.