The vulnerability exists in the userspace verifier function z_vrfy_log_filter_set() for the log_filter_set syscall in Zephyr's logging management subsystem. The function performs a signed comparison on the int16_t src_id parameter against the log source count, allowing negative values such as -1 to pass the check. This negative value is then implicitly converted to a large unsigned integer (0xFFFFFFFF), causing out-of-bounds indexing into the log_dynamic linker-section array. This results in out-of-bounds read and read-modify-write operations in kernel memory, enabling memory corruption and a privilege escalation primitive from an unprivileged user thread. The defect affects builds with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y, present from Zephyr v3.3.0 through v4.4.1. The fix replaces the signed comparison with an unsigned comparison to properly reject negative src_id values.

An attacker controlling the src_id parameter can cause out-of-bounds memory access in kernel space, leading to kernel memory corruption and potential privilege escalation from an unprivileged user thread. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 score of 6.6 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described replaces the signed comparison with an unsigned comparison to reject negative inputs. Until an official patch is available, avoid enabling CONFIG_USERSPACE and CONFIG_LOG_RUNTIME_FILTERING together if possible, or restrict access to the affected syscall. Monitor the Zephyr project advisories for an official fix.