The Zephyr kernel validates k_thread_join() and k_thread_abort() syscalls via thread_obj_validate(). When access is denied (returning -EPERM or -EBADF), the kernel was supposed to raise a kernel oops via K_OOPS. However, due to incorrect use of K_SYSCALL_VERIFY_MSG, the error code was treated as success, preventing the oops and causing execution to reach CODE_UNREACHABLE. On Clang builds, this triggers an illegal instruction trap causing a kernel crash (denial of service). On GCC builds, undefined behavior may allow unauthorized access to thread objects, resulting in an access-control bypass. The fix changes the verification to check for ret == 0, ensuring proper termination of unauthorized calls.

An unprivileged user-mode thread can exploit this vulnerability to cause a local denial of service by crashing the kernel or, depending on the compiler, bypass access controls to thread objects. This breaks the userspace sandbox and can disrupt system stability. There is no indication of confidentiality or integrity impact beyond the described denial of service and access control bypass.

A fix is available that corrects the verification logic to properly raise a kernel oops on access denial, terminating unauthorized callers. Users should upgrade to Zephyr version 4.4.2 or later where this issue is resolved. No additional mitigation is required if the fix is applied.