Vulnerabilities

TI-2026-09173 CVE-2026-10671

User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)

LOW 30

In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVE…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00159 Published 2026-07-14 Fixed in 4.3.1, 4.4.2 CWE-825

TI-2026-09172 CVE-2026-10670

User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier

LOW 24

The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_find() on the caller-supplied thread pointer and then dereferences the re…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00151 Published 2026-07-14 Fixed in 4.3.1, 4.4.2 CWE-476

Vulnerabilities

Filters

User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)

User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier