In Zephyr kernel versions 4.1.0 through before 4.5.0, the userspace syscall verifier for k_pipe_init incorrectly uses K_SYSCALL_OBJ() instead of K_SYSCALL_OBJ_NEVER_INIT(), allowing unprivileged user threads to re-initialize an active k_pipe object. The re-initialization resets internal pipe structures and wait queues without properly handling threads blocked on the pipe, leaving them orphaned with stale wait queue links. Subsequent wake or timeout operations on these orphaned threads cause invalid kernel writes through corrupted doubly-linked list pointers, resulting in kernel data structure corruption, lost wakeups, indefinite thread blocking, and silent data loss. The issue compromises kernel object integrity and availability. The fix involves changing the verifier to K_SYSCALL_OBJ_NEVER_INIT() to prevent re-initialization of live pipes. The vulnerability was introduced in v4.1.0 and persists through v4.4.0.

The vulnerability allows a deprivileged user thread to corrupt kernel wait queue and scheduler data structures by re-initializing an active pipe object. This causes invalid kernel writes leading to list corruption, lost wakeups, indefinitely blocked threads, and silent data loss. The impact affects kernel object integrity and availability but does not disclose confidential information. The CVSS 3.1 base score is 7.1 (High), reflecting low attack complexity but requiring local privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix changes the syscall verifier to prevent re-initialization of live pipes, which should be applied once available. Until then, restrict unprivileged user thread access to k_pipe objects to mitigate exploitation risk.