The zephyrproject’s PECI transfer system call verifier checks only the outer message object’s permissions, but the user‑supplied buffer pointers within the embedded peci_buf structures are not validated. This omission permits a user‑mode process with access to a PECI device object to direct the kernel driver to read from or write to arbitrary kernel memory. Consequently, an attacker can corrupt kernel data, exfiltrate sensitive information via the PECI bus, or trigger a kernel fault, thus creating an attack surface that can lead to code execution at supervisor privilege. The weakness is a classic mis‑validated pointer usage, identified as CWE‑822.

This vulnerability affects the Zephyr RTOS, specifically the PECI drivers that are enabled with the corresponding configuration options: CONFIG_PECI_NPCX, CONFIG_PECI_XEC, or CONFIG_PECI_ITE_IT8XXX2. A user‑mode application that obtains a PECI device object—which is the normal method for exposing a device under CONFIG_USERSPACE—can trigger the exploit if CONFIG_USERSPACE is enabled and any of these drivers are compiled into the kernel.

The vulnerability has a CVSS score of 7.8, indicating a high severity. EPSS is not available and the flaw is not listed in the CISA KEV catalog, but the lack of EPSS does not diminish the risk; the conditions required for exploitation are relatively common in Zephyr deployments that enable userspace and expose PECI drivers. The attack vector is local, relying on user‑mode code executed within the same process space as the kernel driver, and requires no network access. Given the serious potential for kernel compromise, the threat level warrants immediate remediation.