CVE-2026-10681

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.4.1

Description In the userspace dynamic-objects subsystem, the thread idx alloc() function in kernel/userspace/userspace.c allocates a new thread permission index from the global thread idx map[] bitmap without holding the lists lock. On SMP (Symmetric Multiprocessing) systems, two user-mode threads invoking the k object alloc(K OBJ THREAD) syscall concurrently may observe the same free bit and perform a non-atomic Read-Modify-Write (RMW) operation, resulting in both threads receiving the same tidx. Consequently, these threads share the same thread id and alias a single bit position in the perms[] bitfield of kernel objects, which bypasses userspace Access Control List (ACL) isolation. Additionally, a lost-update window between the allocation and the thread idx free() function can lead to leaks in the thread-index pool. This issue is reachable via the k object alloc syscall when CONFIG USERSPACE, CONFIG DYNAMIC OBJECTS, and CONFIG SMP are enabled.

Recommendations Update Zephyr to version 4.4.1 or later.