---
id: CVE-2026-12631
title: >-
  Broken access-control denial in k_thread_join/k_thread_abort syscall
  validation in Zephyr kernel
summary: >-
  The Zephyr kernel validates the k_thread_join() and k_thread_abort() system
  calls (declared __syscall in include/zephyr/kernel.h) through
  thread_obj_validate() in kernel/thread.c. Its default switch branch is the
  access-denied path, take…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-862
vendor: zephyrproject
product: zephyr
affected:
  - zephyr >= 2.3.0 < 4.3.2
  - zephyr >= 4.4.0 < 4.4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-19T13:17:32.022813Z'
published: '2026-08-18'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T04:59:39.284Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-12631'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/bd1828652dfc217ba9f3a2221a7499cd8914ed9c
    label: Fix commit
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-crfw-75jw-hjm3
    label: GHSA-crfw-75jw-hjm3
tags:
  - cve.org
epss: 0.00155
epssPercentile: 0.04652
ingestedAt: '2026-11-05T20:33:06.705Z'
---

## Overview

The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate() in kernel/thread.c. Its default switch branch is the access-denied path, taken when k_object_validate() returns -EPERM (the calling user thread was never granted access to the target thread object) or -EBADF (the supplied pointer is not a registered kernel object of the right type). That branch invoked K_OOPS(K_SYSCALL_VERIFY_MSG(ret, "access denied")), but K_SYSCALL_VERIFY_MSG treats a true expression as success; the non-zero error code ret therefore read as "verified OK", the kernel oops was never raised, and control fell through to CODE_UNREACHABLE.

Because k_thread_join() and k_thread_abort() are system calls, an unprivileged user-mode thread (under CONFIG_USERSPACE) can reach this denial path directly by calling either syscall on a thread object it does not own. Instead of the offending thread being cleanly terminated, execution reaches __builtin_unreachable() while running in supervisor mode inside the syscall handler.

On Clang builds CODE_UNREACHABLE emits an illegal-instruction trap, so a user thread can deterministically crash the kernel — a locally triggerable denial of service that escapes the userspace sandbox. On GCC builds the path is undefined behavior: the compiler may drop the return-value handling for thread_obj_validate(), so it can return an undefined bool; if that is false, the caller proceeds into the real k_thread_join()/k_thread_abort() implementation for a thread the user was never authorized to access, an access-control bypass.

The fix changes the verification expression to ret == 0, so a denied (non-zero) result now correctly raises K_OOPS and terminates the offending caller.

## Affected

- `zephyr >= 2.3.0 < 4.3.2`
- `zephyr >= 4.4.0 < 4.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.