Zephyr’s log_filter_set syscall verifier performs a signed comparison on the src_id argument. When a negative value such as –1 passes the check, it is later converted to an unsigned 32‑bit index. The resulting value 0xFFFFFFFF indexes far beyond the dynamic log filter array, causing the kernel to read and write out of bounds. The write modifies a small 3‑bit log‑level field within a 32‑bit word, but the target address is attacker‑chosen and the modification occurs in supervisor mode, giving a kernel memory‑corruption and potential privilege‑escalation primitive.

Any Zephyr project build from version 3.3.0 through 4.4.1 with CONFIG_USERSPACE=y and CONFIG_LOG_RUNTIME_FILTERING=y is affected. The issue originates in subsys/logging/log_mgmt.c and propagates to the kernel’s dynamic log filter array. The vulnerability is reachable from user space via the log_filter_set syscall.

The CVSS score of 6.6 reflects moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. An attacker who can execute code on the device can invoke the vulnerable syscall from an unprivileged process, causing kernel memory corruption and potentially escalating privileges. The flaw is not listed in CISA KEV, but the direct user‑space trigger simplifies exploitation. The recommended remediation is to apply the vendor patch that changes the signed bound check to an unsigned comparison.