The vulnerability arises from a type confusion bug in the device_deinit system call in Zephyr. The user‑mode verification handler validates the device argument using K_SYSCALL_OBJ_INIT with K_OBJ_ANY, which bypasses the actual object type check. Because the check only verifies that the pointer refers to a kernel object granted to the calling thread, an attacker can supply a writable kernel object, such as a thread stack, that resides in user‑accessible memory. The kernel then interprets the attacker‑controlled memory as a struct device, dereferences a function pointer in the ops.deinit field, and eventually performs a supervisor‑mode indirect call to an arbitrary address, together with arbitrary read and a one‑byte write. This results in full kernel code execution for the local unprivileged thread, completely subverting the CONFIG_USERSPACE isolation boundary.

Vendor and Product: Zephyr Project's Zephyr real‑time operating system. Affected releases include Zephyr v4.2.x and v4.3.x, where CONFIG_DEVICE_DEINIT_SUPPORT was enabled by default, as well as any v4.4.0 or later build that explicitly enables CONFIG_DEVICE_DEINIT_SUPPORT. The older v4.2 line is no longer maintained and does not receive newer backports. Systems built with CONFIG_USERSPACE and with device de‑initialization support compiled in are vulnerable.

The CVSS score of 7.8 classifies the vulnerability as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires only a local unprivileged user thread with permission to hold a kernel object, which is a realistic scenario in many Zephyr deployments. As the vulnerability is limited to builds that enable both user‑space isolation and device de‑initialization support, the exploitability is focused but still quite concerning. Successful exploitation provides the attacker with complete kernel code execution, effectively granting full system compromise and bypassing all security hardening in the affected builds.