CVE-2026-40337

CVE-2026-40337 is a capability escalation vulnerability in the Sentry kernel, a security-focused micro-kernel for embedded systems. Prior to version 0.4.7, tasks granted DEV or IO capabilities can improperly interact with other tasks' IRQ lines through the __sys_int_* syscall family, creating security boundaries violations. The vulnerability carries a CVSS score of 5.1 (Medium) with local attack vector and high privileges required, resulting in potential denial of service and the establishment of covert channels between isolated tasks. The attack has low complexity and can impact system availability while potentially enabling information disclosure. There is no current evidence of active exploitation in the wild. The vulnerability has not been added to the Known Exploited Vulnerabilities catalog, maintains an inactive status on vulnerability hotlists, and shows minimal community attention relative to other CVEs. Patched versions (0.4.7 and later) are available, and administrators can immediately implement the workaround of consolidating DEV and IO capabilities to a single task until patching is completed.