The vulnerability exists in the Zephyr project's userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() functions. These functions copy a user-supplied struct net_msghdr into kernel memory but then re-read the live user memory for subsequent operations, creating a classic double-fetch race condition. A cooperating thread can modify the msg_iovlen field between the initial sizing read and the loop that populates the kernel iovec shadow buffer, causing the loop to write beyond the allocated kernel buffer. This leads to kernel heap corruption crossing the user-to-kernel privilege boundary, enabling local privilege escalation or kernel fault denial of service. The vulnerability is reachable by unprivileged user threads when CONFIG_USERSPACE is enabled and the relevant syscalls are exposed. The fix involves copying the header once and using the snapshot for all size and bound checks, preventing races on iovec entries.

Successful exploitation allows a local unprivileged user thread to corrupt kernel-managed heap memory, potentially resulting in local privilege escalation or a denial of service via kernel fault. The vulnerability compromises confidentiality, integrity, and availability of the kernel.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory does not specify an official fix or patch availability. Users should monitor Zephyr project advisories for updates. Until a fix is available, restricting access to unprivileged user threads or disabling CONFIG_USERSPACE where feasible may reduce risk.