CVE-2026-10659: NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume
The Dhara flash translation layer disk driver (drivers/disk/ftldhara.c) implemented the dharanand callbacks so that, on a flash error, the error code was written unconditionally through the caller-supplied dharaerrort err pointer (e.g. err = DHARAEECC in dharanandread, and similar in dharananderase/prog/copy).
The upstream Dhara library calls these callbacks with err == NULL along its journal-resume binary search: findlastcheckblock() invokes findcheckblock(j, mid, &found, NULL), which forwards the NULL pointer into dharanandread(). This path runs during diskftlaccessinit() -> dharamapresume() whenever the FTL disk is mounted/initialised.
If a flash read error (uncorrectable ECC, bad block, controller error) occurs on one of the probed checkpoint pages, the driver dereferences and writes to NULL, faulting the kernel (denial of service). The trigger is conditioned on the NAND medium content/health, which can be influenced by media wear, induced faults, or a corrupted/crafted on-flash image.
The fix routes all error assignments through the library's NULL-safe dharaseterror() helper. Affects Zephyr v4.4.0, where the driver was introduced.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zephyr Dhara FTL disk driver (drivers/disk/ftl_dhara.c)to a version that resolves this vulnerability.Fixed in 4.4.0 - Configuration
Update the Dhara NAND callback implementations (dhara_nand_read/erase/prog/copy) to use the library's NULL-safe dhara_set_error() helper instead of unconditionally writing through the caller-supplied dhara_error_t* pointer, preventing NULL pointer dereferences when err == NULL.
Dhara FTL disk driver (drivers/disk/ftl_dhara.c) dhara_nand_* error handling (err pointer) = Route error assignments through NULL-safe dhara_set_error() helper so that callbacks tolerate err == NULL (e.g., during journal-resume binary search).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10659?
The severity of CVE-2026-10659 is medium with a base score of 4.7.
What type of vulnerability is CVE-2026-10659?
CVE-2026-10659 is a NULL pointer dereference vulnerability.
How can I remediate CVE-2026-10659?
To remediate CVE-2026-10659, update to the latest version of the Zephyr Project that includes the fix for this vulnerability.
Which software is affected by CVE-2026-10659?
CVE-2026-10659 affects the Zephyr Project's Dhara flash translation layer disk driver.
What impact does CVE-2026-10659 have?
The impact of CVE-2026-10659 can result in denial of service due to a NULL pointer dereference during journal resume operations.