HOMEVULNERABILITIESCVE-2026-40337
MEDIUM

CVE-2026-40337

CWE-283Published: April 18, 2026· Updated: Apr 20, 2026

5.1
CVSS v3.1
EPSS:0.00%probability of exploitation in 30 daysPercentile:0.2th

Official Description

The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A given task with one of the DEV or IO capability is able to interact with another task's IRQ line through the __sys_int_* syscall familly. Prior to version 0.4.7, this can lead to DoS and covert-channels between this task and the outer world. A patch is available in version 0.4.7. As a workaround, reduce tasks that have the DEV and IO capability to a single one.

NVD Source

Technical Analysis

CVE-2026-40337 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 5.1.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges Req.High
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityLow
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

All References (3)

→
https://github.com/camelot-os/sentry-kernel/commit/150b7edd2c5b0da0a8baeed3135ddde613b08081
→
https://github.com/camelot-os/sentry-kernel/pull/108
→
https://github.com/camelot-os/sentry-kernel/security/advisories/GHSA-5hgv-rg2f-79pg

Quick Facts

CVE IDCVE-2026-40337
CVSS Score5.1 / 10
SeverityMEDIUM
WeaknessCWE-283
CISA KEVNo
EPSS (30d)0.00%
PublishedApr 18, 2026

Related CVEs (CWE-283)

CVE-2026-26016
8.1
CVE-2026-29788
7.5
CVE-2026-4269
7.5
CVE-2026-44707
6.8
CVE-2026-44562
6.5
CVE-2026-27486
5.3

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2026-40337 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2026-40337·NVD