Zephyr OS k_pipe_init Reinitialization Vulnerability Causing Kernel List Corruption Analysis

Vulnerability Overview In the Zephyr pipe implementation, the user-space system call verifier uses , which requires the kernel object to be already initialized. However, in builds with , unprivileged user threads can access objects and invoke the system call to re-initialize a pipeline that is already in use. unconditionally resets the ring buffer, sets to 0, and re-initializes both wait queues ( on and ) without checking or waiting for any threads currently blocked on the pipe. Any threads previously blocked on or will remain suspended, with pointing to cleared wait queues, and their linked into (now re-initialized) embedded head lists. When such orphaned threads are subsequently woken up, the scheduler calls on their status lists, writing through dangling / pointers to the kernel wait queue linked list structures. This results in list corruption (due to attacker-driven invalid kernel writes), loss of locks, indefinite blocking of threads, and data leakage. This vulnerability allows user threads to corrupt the state of other threads/processes within the kernel. Scope of Impact Affected Component: Affected Versions: Zephyr v4.1.0 through the development branch, up to this commit. Only builds with are affected. Remediation Fix Status: Merged (in ) Expected Fix Version: 4.5.0 (This fix has been merged into but has not yet been released; this prediction should be confirmed upon actual release) The fix involves switching the verifier to , aligning it with the existing verifier, thereby preventing user threads from re-initializing an in-use pipeline. The vulnerable code exists in v4.1.0 and persists up to v4.4.0. Patches Branch: , Pull Request: , Status: Merged Branch: , Pull Request: , Status: Merged Branch: , Pull Request: , Status: Merged Branch: , Pull Request: None, Status: Not Affected Additional Information Open Issues: Open issues in Contact Us: Contact us via Embargo Date: 2026-07-14

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr OS k_pipe_init Reinitialization Vulnerability Causing Kernel List Corruption Analysis

More from this source