arch_buffer_validate in the Xtensa MPU hook defaulted to permit access when an integer overflow caused the buffer size rounding to wrap the 32‑bit address space. An attacker can supply an (addr, size) pair that overflows the rounded value, causing the validation loop to skip and the function to return success. This allows a user‑mode thread to bypass normal bounds checks on any syscall that relies on k_usermode_* copy functions, resulting in arbitrary reads or writes to kernel or other partition memory. The resulting information disclosure, memory corruption, possible privilege escalation, or denial of service demonstrate a classic buffer over‑read/write flaw (CWE‑787).

Affected products are the Zephyr RTOS when built for Xtensa SoCs configured with CONFIG_XTENSA_MPU and CONFIG_USERSPACE. Versions from 3.7.0 through 4.4.0 are vulnerable. Newer releases after 4.4.0 include the fix that changes the default return value to -EINVAL and adds overflow checks.

The CVSS score of 7.8 places this flaw in the high severity range. The EPSS score is less than 1 %, indicating that, while the vulnerability has been publicly disclosed, its exploitation probability is currently very low. The flaw is not listed in the CISA KEV catalog, but an unprivileged user thread on affected devices can obtain control over arbitrary memory through a local privilege escalation path. The absence of syscall‑layer guards for the ROUND_UP overflow means the attack surface remains intact until a patch or configuration change is applied.