Executive brief
A race condition in the Zephyr operating system's memory management allows two different user programs to be assigned the same internal security identifier. This flaw breaks the isolation between applications, potentially allowing one program to access sensitive data or control hardware resources belonging to another. This issue specifically affects systems using multi-core processors (SMP) where multiple tasks run simultaneously.
Technical details
A race condition exists in the `thread_idx_alloc()` function within `kernel/userspace/userspace.c` due to improper synchronization. On SMP systems, the function fails to hold the `lists_lock` while performing a non-atomic read-modify-write (RMW) operation on the global `_thread_idx_map[]` bitmap. An attacker can trigger this by concurrently invoking the `k_object_alloc(K_OBJ_THREAD)` syscall from multiple user-mode threads. If successful, two distinct thread objects are assigned the same `thread_id`, causing them to alias the same bit position in kernel object permission bitfields. This allows one thread to implicitly inherit any access rights granted to the other, bypassing userspace Access Control List (ACL) protections. The vulnerability is present in versions up to v4.4.1 and is fixed in v4.5.0.
Affected products
- Zephyr Project Zephyr RTOS >= 2.0.0, <= 4.4.1
Timeline
- 2018-08-08: other: Vulnerability introduced in commit e58b654
- 2026-07-25: disclosed: Advisory published by Zephyr Project
- 2026-07-25: patched: Fix merged into main branch (commit 862ea2f)