The vulnerability exists in the z_vrfy_mbox_send() function in Zephyr's mbox driver, where nested msg->data/msg->size fields are validated by reading directly from live userspace memory, but the original mutable pointer is forwarded to the kernel driver. A race condition allows a second thread in the same address space to replace msg->data with a supervisor address after validation but before use, resulting in the kernel reading from an attacker-controlled address. This causes a userspace-to-supervisor access control bypass, enabling kernel memory disclosure or denial of service. The fix involves copying the entire mbox_msg struct into kernel stack memory and validating the immutable copy to close the race window.

This vulnerability allows an unprivileged userspace thread to bypass access controls and cause the kernel to read from arbitrary supervisor memory addresses. The impact includes high confidentiality risk due to potential disclosure of kernel memory contents and a low availability risk from kernel crashes if invalid addresses are read. There is no indication of integrity impact. The CVSS 3.1 base score is 6.4 (medium severity), reflecting local attack vector with high confidentiality impact and low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor's described fix involves copying the entire mbox_msg struct into kernel stack memory and validating that immutable copy to eliminate the race condition. Until an official fix is available, users should consider restricting concurrent userspace threads that can invoke mbox_send() or disabling CONFIG_USERSPACE if feasible to reduce exposure.