CVE-2026-10671: Zephyr Privilege Escalation Vulnerability

CVE-2026-10671 Overview

CVE-2026-10671 is a high-severity kernel vulnerability in the Zephyr real-time operating system (RTOS). The flaw resides in the userspace syscall verifier z_vrfy_k_pipe_init() inside kernel/pipe.c. The verifier used K_SYSCALL_OBJ() instead of K_SYSCALL_OBJ_NEVER_INIT(), allowing an unprivileged user thread to re-initialize a live k_pipe object already in use by other threads. The defect maps to [CWE-825: Expired Pointer Dereference] and affects Zephyr builds compiled with CONFIG_USERSPACE. The vulnerable code shipped in v4.1.0 and remained through v4.4.0.

Critical Impact
A deprivileged user thread can trigger attacker-controlled kernel writes, corrupt scheduler wait-queue structures, orphan pended threads, and cause silent data loss across partitions sharing the pipe.

Affected Products

Zephyr RTOS v4.1.0 through v4.4.0
Zephyr builds compiled with CONFIG_USERSPACE enabled
Applications using k_pipe objects shared across user partitions

Discovery Timeline

2026-07-14 - CVE-2026-10671 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10671

Vulnerability Analysis

The vulnerability sits in the Zephyr kernel pipe syscall boundary. The verifier z_vrfy_k_pipe_init() validated the target pipe object using K_SYSCALL_OBJ(), which requires the kernel object to already be initialized. It should have used K_SYSCALL_OBJ_NEVER_INIT(), which explicitly rejects already-initialized objects. As a result, a user thread with access to a live k_pipe can invoke k_pipe_init a second time and re-initialize a pipe that other threads are actively using.

Inside the implementation, z_impl_k_pipe_init() unconditionally resets the ring buffer, clears pipe->waiting, and reinitializes both wait queues using z_waitq_init on pipe->data and pipe->space. It performs no accounting for threads currently blocked in k_pipe_read() or k_pipe_write(). Any pended waiter is orphaned: still marked pending, with pended_on pointing at the cleared wait queue and qnode_dlist links referencing the re-initialized embedded list head.

Root Cause

The root cause is an incorrect syscall object validation macro. K_SYSCALL_OBJ() accepts initialized kernel objects, which is the wrong contract for an initializer syscall. The correct macro, K_SYSCALL_OBJ_NEVER_INIT(), is already used by the analogous k_msgq_init verifier. The mismatch created a policy gap in the userspace boundary.

Attack Vector

The attack is local. An unprivileged user thread already granted access to a k_pipe object invokes k_pipe_init a second time. When an orphaned waiter is later timed out or woken, the scheduler calls sys_dlist_remove() on stale prev/next pointers, writing through dangling references into kernel wait-queue and scheduler structures. This produces list corruption, lost wakeups, indefinitely blocked threads, and an attacker-driven invalid kernel write.

 #ifdef CONFIG_USERSPACE
 void z_vrfy_k_pipe_init(struct k_pipe *pipe, uint8_t *buffer, size_t buffer_size)
 {
-	K_OOPS(K_SYSCALL_OBJ(pipe, K_OBJ_PIPE));
+	K_OOPS(K_SYSCALL_OBJ_NEVER_INIT(pipe, K_OBJ_PIPE));
 	K_OOPS(K_SYSCALL_MEMORY_WRITE(buffer, buffer_size));
 
 	z_impl_k_pipe_init(pipe, buffer, buffer_size);

Source: GitHub Zephyr Commit 4424aa681e. The patch replaces the permissive verifier with K_SYSCALL_OBJ_NEVER_INIT(), blocking re-initialization of a live pipe from user context.

Detection Methods for CVE-2026-10671

Indicators of Compromise

Unexpected kernel oops or fault traces originating in sys_dlist_remove() or scheduler wait-queue code paths.
User threads observed calling k_pipe_init on pipes already registered to another partition or thread.
Threads that remain in a PENDING state after their timeout should have fired, or wakeups that never occur on active pipes.

Detection Strategies

Audit Zephyr application source and partition manifests for any user-mode invocation of k_pipe_init on shared pipe objects.
Instrument development builds with kernel assertions and stack traces around z_waitq_init, sys_dlist_remove, and k_pipe_init to catch re-initialization attempts.
Compare deployed Zephyr version against the fixed release and flag any firmware in the v4.1.0 through v4.4.0 range with CONFIG_USERSPACE=y.

Monitoring Recommendations

Collect and centralize Zephyr fault logs, panic traces, and reboot causes from fielded devices for anomaly review.
Track pipe-related syscall counts per user partition and alert on repeated k_pipe_init calls against the same object.
Monitor for silent data loss symptoms such as stalled producer/consumer threads communicating over k_pipe.

How to Mitigate CVE-2026-10671

Immediate Actions Required

Upgrade Zephyr to a release containing commit 4424aa681e0b80e9cbd0ae27a987d582be88cb74 and rebuild all firmware images.
Review CONFIG_USERSPACE builds and confirm no unprivileged partition retains write access to shared k_pipe objects it does not own.
Rebuild and redeploy affected devices; kernel-level fixes cannot be hot-patched in most Zephyr deployments.

Patch Information

The fix switches z_vrfy_k_pipe_init() to use K_SYSCALL_OBJ_NEVER_INIT(), matching the existing k_msgq_init verifier. Details are published in the GitHub Security Advisory GHSA-p8w8-3x99-mg8f and the upstream Zephyr commit.

Workarounds

If patching is not immediately feasible, restrict k_pipe object grants so no user thread holds access unless it is the sole owner initializing the pipe.
Initialize all k_pipe objects from privileged supervisor context at boot and never expose the raw object to user partitions that could call k_pipe_init.
Remove or disable CONFIG_USERSPACE on devices that do not require user-mode isolation until an upgrade is applied.

bash

# Verify Zephyr version and rebuild against a fixed release
west list -f "{name} {revision}" | grep zephyr
west update
west build -p always -b <board> <application>