The vulnerability resides in the user‑space verifier of the Zephyr logging system. The verifier simply forwards user‑supplied arguments to the kernel implementation without performing any K_SYSCALL_* checks. An unprivileged thread can therefore provide arbitrary kernel pointers and lengths. When the kernel processes these values, it dereferences and copies from them, which leads to a fault (kernel‑mode denial of service) and, if a log backend is visible, the leakage of arbitrary kernel memory. The flaw does not corrupt kernel memory, so there is no out‑of‑bounds write.

Zephyr RTOS, as distributed by the zephyrproject:zephyr vendor, is affected when it contains the unpatched logging subsystem. The exact version is not specified, but any build that includes the current log_msg.c implementation before the patch commit 77aa26d8 is vulnerable.

Because the call is marked __syscall, any unprivileged user thread can invoke it, making exploitation straightforward from user space. The CVSS score of 8.4 reflects a high severity, yet the EPSS score is unknown; the vulnerability is not listed in CISA’s KEV catalog. An attacker that can read the back‑end logs can obtain kernel data, and an attacker that can trigger a fault can cause a denial of service. The lack of a write primitive limits the damage to reading and crash rather than crash‑and‑deface.