The flash_copy() system call in Zephyr was verified only against the destination buffer, while the source and destination device pointers were passed unchecked into the driver implementation. An unprivileged user process could forge a struct device whose API table contains malicious function pointers, causing the kernel to execute arbitrary code in supervisor mode. This results in a local privilege escalation, with denial‑of‑service and optional information disclosure as secondary effects.

Zephyr Kernel – any build that enables CONFIG_USERSPACE and exposes the flash_copy() syscall is affected. The vulnerability manifests in all recent Zephyr releases prior to the commit that introduces device‑pointer validation. The affected products are listed under the cnvner field zephyrproject:zephyr; specific version ranges are not supplied. Adapters that rely on flash_copy() in a userspace context will be susceptible.

The CVSS score of 8.8 classifies the flaw as high severity. Despite no EPSS data, the exploit is conceptually straightforward for a local attacker who can craft a forged device structure. Once the kernel dereferences the supplied pointers, it invokes driver callbacks via the faux API table, handing the attacker complete privilege. The flaw has not yet been listed in the CISA KEV catalog, but its high CVSS rating and local nature warrant immediate attention. Attackers require only a userspace process with the ability to call flash_copy() and control of the memory that holds the forged device structures. The potential impact is full kernel compromise with elevated privileges, making exploitation highly consequential.