The vulnerability is a race condition in Zephyr's userspace dynamic‑objects subsystem. Two user‑mode threads may concurrently allocate thread permission indices that collide, giving each thread the same thread_id and permission bit. Consequently, ACL enforcement in the kernel is broken, allowing one thread to grant device or object access to another. This flaw permits malicious users to bypass userspace ACL isolation and gain unauthorized access to kernel objects, effectively escalating privileges.

Zephyr RTOS, versions up to and including v4.4.0, compiled with CONFIG_USERSPACE, CONFIG_DYNAMIC_OBJECTS, and CONFIG_SMP. The flaw resides in kernel/userspace/userspace.c's thread_idx_alloc function in the dynamic‑objects subsystem. All builds that include this code and allow concurrent k_object_alloc calls on SMP hardware are affected. The issue originates from the commit 862ea2fbbeb2ccdf8ff994b03e2e3b4405f2c37d and is documented in the GitHub advisory GHSA-j693‑5rh5‑8g8h.

The CVSS score of 6.5 indicates medium severity. The EPSS score is below 1%, implying a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the attack is local because it requires user‑mode threads to call k_object_alloc concurrently. A multi‑core configuration with the relevant options enabled is required, but such a setup is typical for Zephyr deployments that use userspace and dynamic objects. If the race occurs, a malicious thread can impersonate another, granting itself privileged access to protected kernel objects and bypassing isolation. The secondary lost‑update window could also cause pool leaks, but this is secondary compared to the ACL compromise.