CVE-2026-10671

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.1.0 through 4.4.0

Description In the kernel pipe implementation, the userspace syscall verifier z vrfy k pipe init() in kernel/pipe.c incorrectly used K SYSCALL OBJ() instead of K SYSCALL OBJ NEVER INIT(). On builds with CONFIG USERSPACE, this allows an unprivileged user thread with access to a k pipe object to call the k pipe init syscall to re-initialize a pipe already in use. The function z impl k pipe init() resets the ring buffer and re-initializes wait queues without accounting for threads currently blocked on the pipe. This leaves threads pended in k pipe read() or k pipe write() orphaned with stale links. When these orphaned waiters are woken or timed out, the scheduler calls sys dlist remove() on the stale node, leading to invalid kernel writes through dangling pointers. This results in list corruption, lost wakeups, indefinitely blocked threads, and silent data loss, allowing a deprivileged user thread to corrupt a kernel object shared with other threads or partitions.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary mitigation, restrict unprivileged user thread access to the k pipe init syscall.