In Zephyr OS on Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, the function arch_buffer_validate() incorrectly defaults to permitting access (return 0) and only denies access inside a loop that probes MPU regions. When the buffer's rounded extent causes a 32-bit address wraparound, the loop does not execute, resulting in an implicit permit without validation. Syscall-layer pre-checks do not catch this specific wraparound condition. Consequently, an unprivileged user-mode thread can supply a crafted buffer to syscalls that validate user buffers, causing the kernel to read or write memory it should not access. This leads to information disclosure, memory corruption, privilege escalation, and denial of service. The vulnerability affects Zephyr versions from 3.7.0 (when Xtensa MPU userspace support was added) through 4.4.0. The fix changes the default return value to -EINVAL (deny by default), adds explicit overflow checks, and sets success only after full validation.

An attacker with unprivileged user-mode access on affected Zephyr OS versions can bypass memory access validation checks for user-supplied buffers. This allows unauthorized kernel memory disclosure, corruption, privilege escalation, and denial of service. The vulnerability affects systems running on Xtensa SoCs with MPU and userspace enabled, potentially compromising system integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix changes the default validation result to deny access, adds explicit overflow checks, and ensures full buffer validation before permitting access. Until an official patch or update is available, avoid running untrusted user-mode code on affected Zephyr versions with Xtensa MPU userspace enabled.