On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, the arch_buffer_validate() function in arch/xtensa/core/mpu.c incorrectly defaults to permitting access (return value 0) and only denies access inside its MPU region probe loop. When the buffer's rounded extent wraps the 32-bit address space due to size and alignment overflow, the probe loop executes zero iterations, causing the function to incorrectly permit access without validation. Syscall-layer pre-checks do not cover this overflow scenario, allowing an unprivileged user-mode thread to pass crafted (address, size) parameters to syscalls that validate user buffers, bypassing MPU checks. This leads to potential kernel or partition memory disclosure, corruption, privilege escalation, and denial of service. The vulnerability affects Zephyr from version 3.7.0 (when Xtensa MPU userspace support was introduced) through 4.4.0. The patch changes the default return to -EINVAL (deny by default), adds explicit overflow checks, and only returns success after full validation.

An unprivileged user-mode thread can bypass MPU-based memory access validation by exploiting address and size overflow in buffer validation, leading to unauthorized read or write access to kernel or other protected memory regions. This can result in information disclosure, memory corruption, privilege escalation, and denial of service on affected Zephyr systems running on Xtensa SoCs with MPU and userspace enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix changes the default return value to deny access and adds explicit overflow checks. Until an official fix is confirmed, users should monitor vendor advisories for patches addressing this issue and apply them promptly once available.