The vulnerability exists in the CONFIG_USERSPACE syscall verifier function z_vrfy_k_poll() in kernel/poll.c of Zephyr. It allocates a kernel-side copy of the user-supplied k_poll_event array using z_thread_malloc(), then validates each event's object handle. Prior to the fix, if an invalid handle was detected, the code would kill the calling thread without freeing the allocated buffer, causing a memory leak. Because user threads inherit the parent's resource pool, an attacker can spawn multiple threads to repeatedly leak memory until the kernel heap is exhausted. This leads to failure of legitimate kernel allocations and a system-level denial of service. The fix replaces the inline K_OOPS calls with a conditional goto that frees the buffer before killing the thread. The vulnerability affects Zephyr releases from v1.12.0 through v4.4.1.

Exploitation results in a denial of service due to kernel heap exhaustion. Legitimate kernel allocations such as k_queue allocation nodes, k_msgq buffers, and future k_poll calls fail once the heap is depleted. There is no impact on confidentiality or integrity. The CVSS 3.1 base score is 6.5 (medium severity), reflecting local attack vector, low complexity, low privileges required, no user interaction, scope changed, no confidentiality or integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix replaces inline K_OOPS calls with a conditional free before thread termination to prevent memory leaks. Until an official fix is available, consider restricting untrusted user threads from invoking k_poll syscalls or limit the number of spawned threads to mitigate heap exhaustion. Monitor vendor communications for an official patch or update.