A static mutex used by the PSA Protected Storage TLS credential backend was zero‑initialized but never properly constructed, leaving its wait‑queue list pointers NULL. When multiple threads attempted to acquire the lock simultaneously, the blocking path appended a node to this malformed list and dereferenced a NULL tail pointer, triggering a kernel panic and device reset. The fault occurs deterministically on the first contention and does not corrupt memory beyond the dereference, so no confidentiality or integrity impact exists; the vulnerability simply halts the system.

Environments that build the Zephyr Project kernel with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE enabled – particularly PSA Protected Storage or TF‑M based platforms – are affected. The default volatile RAM credential backend initializes its lock correctly and is not impacted.

The CVSS score of 5.9 reflects a moderate severity denial of service. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, so the publicly known exploitation probability remains uncertain. Attackers can trigger the crash by inducing concurrent TLS handshakes or credential operations, for example by generating multiple simultaneous connections to an embedded server that uses this backend.