Zephyr RTOS CVE-2026-10671

Exploitation requires a Zephyr build compiled with CONFIG_USERSPACE, an attacker-controlled unprivileged user thread, and that thread having been explicitly granted access permission to a k_pipe kernel object that is actively shared and in use by other threads. The trigger is invoking the k_pipe_init syscall to re-initialize that already-initialized, live pipe; the damaging invalid kernel write only materializes when a thread is (or becomes) pended in k_pipe_read()/k_pipe_write() on that pipe and is subsequently timed out or woken. Limiting factors that reduce realistic risk: the attack is local only (AV:L) and needs an existing low-privilege foothold (PR:L), it does not affect default builds without CONFIG_USERSPACE, and it requires the specific configuration where a user thread holds a permission grant to a shared pipe object - firmware that never exposes pipes to user threads is not exploitable.

The CVSS 3.1 base score is 7.1 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, indicating a local, low-complexity attack requiring only low privileges and no user interaction, with high integrity and availability impact but no confidentiality impact. This is fundamentally a local privilege-context integrity/availability bug, not a remote or information-disclosure issue, so real-world priority is high only for products that actually ship CONFIG_USERSPACE with user threads granted access to shared pipe objects - a specific, non-default deployment shape. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified and no public exploit is identified at time of analysis. Note a conflicting signal: the input Tags label this 'Information Disclosure,' but the CVSS vector explicitly sets C:N and the description describes kernel-memory corruption and data loss, not disclosure - the tag appears inaccurate and integrity/availability is the true impact. There is also a scope consideration worth verifying: the description says the flaw corrupts a kernel object shared across threads/partitions, which could argue for a scope change (S:C), yet the published vector uses S:U; defenders operating multi-partition userspace configurations should treat cross-partition impact as plausible.

On a CONFIG_USERSPACE Zephyr firmware image where an unprivileged partition has been granted access to a k_pipe shared with a higher-trust thread, a compromised or malicious user thread invokes the k_pipe_init syscall a second time on that in-use pipe while another thread is blocked in k_pipe_read()/k_pipe_write(). When the orphaned waiter is later timed out or woken, the scheduler dereferences its stale list node and writes through dangling pointers into kernel structures, corrupting wait-queue/scheduler state. No POC was provided, and the local attack vector with low complexity means a foothold as an unprivileged user thread is the main prerequisite.