In Zephyr kernel pipe implementation, the verification of the k_pipe_init syscall incorrectly permits re‑initialization of an already initialized pipe when CONFIG_USERSPACE is enabled. This allows an unprivileged user thread to reset the pipe’s ring buffer and re‑initialize its wait queues while other threads are blocked on the pipe. When those blocked threads are later awakened or timeout, the kernel attempts to remove their stale wait‑queue nodes, leading to an invalid kernel write, list corruption, lost wakeups, permanent deadlocks, and silent data loss. The flaw enables kernel state corruption that can cause a denial of service and data loss but does not provide direct arbitrary code execution.

All Zephyr project builds compiled with CONFIG_USERSPACE enabled that use the k_pipe API are affected. The vulnerability existed in versions 4.1.0 through 4.4.0. Subsequent releases beyond 4.4.0 include a fix that changes the syscall verifier to reject re‑initialization of live pipes.

The CVSS score of 7.1 indicates high severity, whereas the EPSS score of <1% suggests that spontaneous exploitation is currently unlikely. The vulnerability is not catalogued in CISA KEV. An attacker must be able to run an unprivileged user thread on a CONFIG_USERSPACE system and invoke k_pipe_init while the pipe is in use. Once triggered, the resulting kernel corruption can lead to denial of service or data loss. While the attack path requires specific kernel configuration, the impact on an embedded system could be severe.