Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-10671— User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 zephyrproject zephyr 4.1.0版本至4.4.0版本存在资源管理错误漏洞，该漏洞源于内核管道实现中使用了错误的系统调用验证器，导致非特权用户线程可以重新初始化正在使用的管道，造成列表损坏、丢失唤醒、线程阻塞和数据丢失。

CVSS 7.1 · High EPSS 0.16% · P4

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.1.0< 4.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-10671

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)
Source: CVE Program / CVE List V5
Vulnerability Description
In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVER_INIT() (which rejects an already-initialized object). As a result, on CONFIG_USERSPACE builds an unprivileged user thread that has been granted access to a k_pipe object can invoke the k_pipe_init syscall to re-initialize a pipe that is already in use. z_impl_k_pipe_init() unconditionally resets the ring buffer, sets pipe->waiting to 0, and re-initializes both wait queues (z_waitq_init on pipe->data and pipe->space) without waking or accounting for threads currently blocked on the pipe. Any thread already pended in k_pipe_read()/k_pipe_write() is left orphaned: still marked pending with pended_on pointing at the cleared wait queue and with stale qnode_dlist links into the (now re-initialized) embedded list head. When such an orphaned waiter is later timed out or woken, the scheduler calls sys_dlist_remove() on its stale node, writing through dangling prev/next pointers into kernel wait-queue/scheduler structures, causing list corruption (an attacker-driven invalid kernel write), lost wakeups, indefinitely blocked threads, and silent data loss. The flaw lets a deprivileged user thread corrupt the state of a kernel object shared with other threads/partitions. The fix switches the verifier to K_SYSCALL_OBJ_NEVER_INIT(), matching the existing k_msgq_init verifier, so a user thread can no longer re-initialize a live pipe. The vulnerable code shipped in v4.1.0 and remained through v4.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
无效指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
zephyrproject zephyr 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 zephyrproject zephyr 4.1.0版本至4.4.0版本存在资源管理错误漏洞，该漏洞源于内核管道实现中使用了错误的系统调用验证器，导致非特权用户线程可以重新初始化正在使用的管道，造成列表损坏、丢失唤醒、线程阻塞和数据丢失。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.1.0 ~ 4.5.0 -

II. Public POCs for CVE-2026-10671

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-10671

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-10671 (1)

Vendor Advisories for CVE-2026-10671 (1)

Same Patch Batch · zephyrproject · 2026-07-14 · 4 CVEs total

CVE-2026-10672 8.2 HIGH Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)
CVE-2026-10669 7.8 HIGH Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall poi
CVE-2026-10670 5.5 MEDIUM User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall v

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-825

V. Comments for CVE-2026-10671

No comments yet

Leave a comment