Enabling the ARM hardware FPU in Zephyr without FPU register sharing causes the system to leave the 16 callee‑saved single‑precision registers (s16‑s31) in an inconsistent state during context switches. When a thread that uses floating‑point instructions finishes, the kernel does not save those register values, and a subsequent thread can read them. In a userspace configuration, the read is performed by an unrelated unprivileged thread, producing an information disclosure that is limited to the contents of those registers. The flaw corresponds to CWE-200 and, due to its confined scope and opportunistic nature, has a low impact rating. The vulnerability does not corrupt data or crash the system when userspace is disabled; it only leads to cross‑thread state corruption that can cause correctness faults.

Any Zephyr RTOS build for ARM that has CONFIG_FPU enabled while CONFIG_FPU_SHARING remains disabled, using the default hard‑ABI floating‑point configuration. Older releases prior to the commit that introduces automatic FPU sharing are especially susceptible.

The CVSS score of 3.6 indicates a low severity risk. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog, which suggests that exploitation is not widespread. The attack requires a local context where an attacker can run an unprivileged thread on the same hardware, and the attacker must know that the target thread has used FP instructions. Because the leakage is tied to the 16 callee‑saved registers, the amount of recoverable information is small and dependent on the victim’s use of floating‑point data. Consequently, the likelihood of exploitation is limited, although the knowledge of a code path that writes to these registers could allow a targeted attack.