CVE-2026-40337
April 18, 2026, 12:16 a.m.
5.1
Medium
Description
The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A given task with one of the DEV or IO capability is able to interact with another task's IRQ line through the __sys_int_* syscall familly. Prior to version 0.4.7, this can lead to DoS and covert-channels between this task and the outer world. A patch is available in version 0.4.7. As a workaround, reduce tasks that have the DEV and IO capability to a single one.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Sentry |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-283
Unverified Ownership
The product does not properly verify that a critical resource is owned by the proper entity.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | sentry | sentry_kernel | <0.4.7 | / | / | / | / | / | / | / |
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: LOCAL
- Attack Complexity: LOW
- Privileges Required: HIGH
- Scope: UNCHANGED
- Confidentiality Impact: LOW
- Integrity Impact: NONE
- Availability Impact: HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
Timeline
Published: April 18, 2026, 12:16 a.m.
Last Modified: April 18, 2026, 12:16 a.m.
Last Modified: April 18, 2026, 12:16 a.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.