The vulnerability exists because the user-space system-call verifier function z_vrfy_z_log_msg_static_create() in Zephyr OS's logging subsystem did not perform required K_SYSCALL_* validation checks on its arguments before passing them to the kernel-mode implementation. This allowed unprivileged user-mode threads to supply arbitrary pointers and lengths for source, desc, package, and data parameters. The kernel-mode handler then dereferenced these pointers without verification, leading to out-of-bounds reads of kernel memory. The impact includes kernel-mode denial of service due to faults on invalid pointer dereferences and potential disclosure of arbitrary kernel memory in log messages, violating the user/kernel memory isolation. The vulnerability does not permit kernel memory corruption or writes. The fix involves adding bounds checking on desc.package_len, rejecting mismatched non-NULL/length parameters, and applying K_SYSCALL_MEMORY_READ() checks to the pointers to ensure only valid user memory is accessed, causing kernel faults on invalid accesses instead of unsafe reads.

An unprivileged user-mode thread can invoke the vulnerable syscall with crafted arguments to cause the kernel to dereference arbitrary kernel addresses, resulting in a denial of service via kernel faults. Additionally, if the log backend output is observable by the attacker, arbitrary kernel memory can be disclosed in emitted log messages, breaching confidentiality across the user/kernel boundary. There is no kernel memory corruption or privilege escalation possible through this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix adds mandatory validation and bounds checking to the syscall verifier to prevent out-of-bounds reads and kernel faults. Until an official fix is available, restrict unprivileged user-mode thread access to this syscall if possible. Monitor vendor channels for patch releases and apply updates promptly once available.