The Dhara flash translation layer disk driver in Zephyr (drivers/disk/ftl_dhara.c) implemented callbacks that write error codes via a caller-supplied pointer without verifying if the pointer is NULL. The upstream Dhara library calls these callbacks with a NULL error pointer during its journal-resume binary search process. If a flash read error occurs on checkpoint pages during disk initialization, the driver attempts to write to a NULL pointer, causing a kernel fault and denial of service. This vulnerability affects Zephyr versions 4.4.0 up to but not including 4.5.0, where the driver was introduced. The fix involves routing error assignments through a NULL-safe helper function.

A NULL pointer dereference can occur during disk initialization if a flash error is encountered on checkpoint pages, causing the kernel to fault and resulting in a denial of service. The trigger depends on NAND medium conditions such as wear, induced faults, or corrupted on-flash images. There is no impact on confidentiality or integrity, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by routing error assignments through a NULL-safe helper function. Until an official fix is available, avoid using affected versions or mitigate exposure to corrupted NAND media that could trigger the fault.