CVE-2026-40317 Details

A privilege escalation vulnerability has been identified in NovumOS, a custom 32-bit operating system developed in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 (JumpToUser) allows Ring 3 user-mode processes to jump to arbitrary kernel addresses and execute code in Ring 0 context. This vulnerability arises because the syscall accepts entry point addresses from user-space registers without proper validation, enabling local privilege escalation. The issue has been fixed in NovumOS version 0.24.

Users are advised to update to NovumOS version 0.24, which addresses this vulnerability by implementing validation for Syscall 12 to ensure that entry points are within the appropriate user-space range. If an immediate update is not possible, users can restrict syscall access by running the system in single-user mode without Ring 3, and by disabling user-mode processes, allowing only the kernel shell to run.