{"metadata": {"vulnerability": "CVE-2026-91007", "count": 7, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 3}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-14T16:03:57.414Z", "date_only": false, "value": "2026-09-14T16:03:57.414Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-91007", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T15:19:20.012Z", "date_only": false, "value": "2026-11-12T15:19:20.012Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-91007", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T15:19:20.012Z", "date_only": false, "value": "2026-11-12T15:19:20.012Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-91007", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T15:19:20.012Z", "date_only": false, "value": "2026-11-12T15:19:20.012Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / zephyr", "record": "CVE-2026-91007", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T15:26:38.373Z", "date_only": false, "value": "2026-11-12T15:26:38.373671Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117604168322213903", "record": "CVE-2026-91007", "field": "creation_timestamp", "uuid": "6fb631a1-cd79-4c7e-ad0d-02643730d2b3", "content": "CVE-2026-91007 Arbitrary supervisor-mode function pointer injection via charger_set_prop() syscall in the charger driver API The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the prop argument before copying union charger_propval across the user/kernel boundary. Two members of that union are function pointers \u2014 status_notification (CHARGER_PROP_STATUS_NOTIFICATION) and online_notification (CHARGER_PROP_ONLINE_NOTIFICATION), declared in include/zephyr/drivers/charger.h \u2014 and z_vrfy_charger_set_prop() forwarded the caller-supplied union verbatim to the driver's set_property callback for any property. z_vrfy_charger_get_prop() had the mirror defect and copied the stored kernel callback address back out to user memory.\nWith CONFIG_USERSPACE enabled, any user-mode thread that has been granted a charger device object could call charger_set_prop() with CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION and an arbitrary pointer value. Drivers that implement these properties \u2014 drivers/charger/charger_max20335.c, drivers/charger/charger_pf1550.c and drivers/charger/charger_bq2518x.c \u2014 store the pointer in device data and later invoke it from their interrupt work handlers, which run in supervisor mode, on any charger state change such as a cable plug/unplug.\nThe result is a control-flow hijack at kernel privilege from an unprivileged thread, defeating the isolation that CONFIG_USERSPACE is meant to provide; the read path additionally disclosed a kernel code address to user mode, and clearing a notifier installed by a supervisor thread let user mode suppress charger notifications. Supervisor-mode callers of charger_set_prop()/charger_get_prop() are unaffected.\nThe fix makes both verifiers reject the two notifier properties outright \u2014 including when the supplied callback is NULL, since the notifiers are device state \u2014 and adds a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT so that new properties force a re-review of the union's user-mode safety.\nhttps://www.cve.org/CVERecord?id=CVE-2026-91007https://github.com/zephyrproject-rtos/zephyr/commit/5467b7a73fe093d7e9562ee15c321cf8f1639d17https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jr35-f52j-fm88#zephyrproject #zephyr#CVE_2026_91007#bot", "url": "https://infosec.exchange/users/cve/statuses/117604168322213903"}, {"timestamp": "2026-11-12T16:19:21.250Z", "date_only": false, "value": "2026-11-12T16:19:21.250", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-91007", "record": "FKIE_CVE-2026-91007", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T16:19:21.370Z", "date_only": false, "value": "2026-11-12T16:19:21.370", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-91007", "record": "FKIE_CVE-2026-91007", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T00:34:53.578Z", "anchors": {"origin": {"timestamp": "2026-11-12T15:19:20.012Z", "date_only": false, "value": "2026-11-12T15:19:20.012Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-91007", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T15:19:20.012Z", "date_only": false, "value": "2026-11-12T15:19:20.012Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-91007", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 33333.566912, "hours": 9.259324142222223, "days": 0.3858051725925926, "min_seconds": 33333.566912, "max_seconds": 33333.566912, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T15:19:20.012Z", "date_only": false, "value": "2026-11-12T15:19:20.012Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-91007", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T00:34:53.578Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}