In Zephyr kernel versions starting from 4.1.0, the userspace syscall verifier for k_pipe_init incorrectly uses K_SYSCALL_OBJ() instead of K_SYSCALL_OBJ_NEVER_INIT(), allowing unprivileged user threads to re-initialize an already initialized k_pipe object. The re-initialization resets internal pipe structures and wait queues without properly handling threads blocked on the pipe, leaving them orphaned with stale wait queue links. Subsequent wake or timeout operations on these orphaned threads cause sys_dlist_remove() to write through dangling pointers, corrupting kernel wait-queue and scheduler structures. This results in invalid kernel writes, lost wakeups, indefinitely blocked threads, and silent data loss. The fix involves switching the verifier to K_SYSCALL_OBJ_NEVER_INIT(), preventing re-initialization of live pipes. The vulnerability was present from version 4.1.0 through 4.4.0. No vendor advisory or patch link is provided in the input data.

An unprivileged user thread with access to a k_pipe object can corrupt kernel memory by re-initializing an active pipe, causing invalid kernel writes and corruption of kernel wait-queue and scheduler data structures. This can lead to lost wakeups, threads blocked indefinitely, and silent data loss. The vulnerability compromises kernel stability and integrity but does not directly impact confidentiality. The CVSS 3.1 score is 7.1 (High), reflecting low attack complexity but requiring local privileges and resulting in high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves changing the syscall verifier to reject re-initialization of already initialized k_pipe objects by using K_SYSCALL_OBJ_NEVER_INIT(). Until an official patch is confirmed, restrict unprivileged user thread access to k_pipe objects to prevent exploitation.