The Zephyr RTOS userspace syscall verifiers for zsock_sendmsg and zsock_recvmsg perform a double fetch of the msg_iovlen field, allowing a local thread to race and inflate the iovec count between sizing and population. This leads to an out‑of‑bounds write into the kernel‑heap shadow buffer, corrupting kernel memory across the userspace boundary. An attacker can exploit this to elevate privileges locally or trigger a kernel fault causing a denial of service.

The vulnerability affects Zephyr RTOS with CONFIG_USERSPACE enabled and the zsock_sendmsg/zsock_recvmsg syscalls present. No specific version range is supplied, so any build that includes the original implementation of these verifiers is potentially impacted. Devices running the affected Zephyr kernel and any unprivileged user applications that invoke these syscalls are at risk.

The CVSS score is 7.8, indicating a high severity local privilege‑escalation or DoS risk. No EPSS data is available, and the issue is not listed in the CISA KEV catalogue. The attack vector is local: an attacker must run code within the same memory domain as the vulnerable process and coordinate a race on the msg_iovlen field. Although the exploit requires race conditions, the kernel heap corruption can result in uncontrolled privilege escalation if successful.