The vulnerability occurs because the Xtensa MMU userspace port fails to initialize the per‑thread page‑table pointer during thread creation. When a thread object is allocated from a caller's resource pool without zeroing, the stale pointer is treated as a valid base for a level‑1 page table. The kernel follows this pointer, performs unguarded accesses, and writes over arbitrary supervisor‑mode memory. An attacker can trigger a kernel panic, corrupt critical kernel structures, or escape the user‑mode sandbox, effectively gaining unrestricted access to the system.

The affected product is Zephyr Project Zephyr on the Xtensa architecture, specifically builds that enable CONFIG_XTENSA_MMU, CONFIG_USERSPACE, and dynamic allocation of kernel objects. Exact version information is not provided in the data; any build that matches these configuration flags may be vulnerable.

The CVSS score of 7.8 indicates a high severity vulnerability. Although no EPSS score is available, the exploit requires an unprivileged user‑mode thread in a system that permits dynamic allocation of kernel objects, which is a realistic scenario in many embedded deployments. It is not currently listed in the CISA KEV catalog, but the described bypass of user‑mode isolation makes it a strong candidate for exploitation once an attacker can spawn a malicious thread.