CVE-2026-16513
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in the RTIO syscall verifier in Zephyr RTOS (before v4.3.0) allows an unprivileged user thread to write a pointer to controlled data at an arbitrary kernel address. The missing K_SYSCALL_MEMORY_WRITE check for the handle output parameter enables privilege escalation to kernel mode.
Risk Assessment
An attacker can overwrite kernel function pointers, thread structures, or memory domain partition tables, leading to full system compromise or crash. This breaks the isolation provided by CONFIG_USERSPACE.
Recommendation
Update Zephyr RTOS to version 4.3.0 or later, which includes the fix adding write validation for the handle parameter. If updating is not possible, restrict access to RTIO objects to trusted threads only.
Other vulnerabilities in Zephyr RTOS
See all- CVE-2026-19185High
A vulnerability was found in the system-call verifier for i3c_do_ccc() in Zephyr RTOS, which fails to validate per-target data pointers in the i3c_ccc_payload structure. The verifier also operates on the caller's live structure, allowing another thread to modify fields between check and use. This allows an unprivileged thread to write to arbitrary kernel addresses (via read CCC) or disclose kernel memory (via write CCC), leading to privilege escalation.
- CVE-2026-18747Medium
A vulnerability in the SMP-over-console transport in Zephyr RTOS allows an unauthenticated attacker to trigger a buffer length underflow by sending a single 7-byte frame to the management console. This leads to an out-of-bounds read, potentially causing a denial of service on the MCUmgr thread or memory disclosure.
- CVE-2026-18417Medium
In Zephyr RTOS, a vulnerability exists in the BSD socket layer where an asynchronous error was stored in the user_data field of the network context, which for listening TCP sockets is used to store a pointer to the parent context. In v4.3.0, after an interface-down event, the accept callback was not disarmed, leading to reuse of the poisoned value as a pointer and writes to an invalid address, causing a kernel fatal error (device crash or reset).
- CVE-2026-16514Medium
The gptp_mi_qualify_announce() function in Zephyr's gPTP subsystem processes received Announce messages by comparing clock identities. The comparison loop uses an attacker-controlled step count (steps_removed) instead of the actual number of TLV entries, leading to an out-of-bounds read. A single frame can cause about 2KB of overread, potentially crashing the networking RX thread and causing denial of service.
- CVE-2026-16512Low
The gptp_handle_msg() function in Zephyr RTOS does not validate the received frame length before dereferencing the gPTP header pointer. A truncated frame can lead to out-of-bounds reads, disclosing stale memory contents.
- CVE-2026-14696Medium
A vulnerability in Zephyr RTOS causes network buffer (net_pkt) leaks when Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE). Frames with unrecognized EtherType that are also delivered to the local stack are marked as NET_OK, which is interpreted as consumed, but they are never freed. An attacker on the L2 segment can flood broadcast/multicast frames with arbitrary EtherType, exhausting the RX buffer pool and causing a persistent denial of service until reboot.
- CVE-2026-13480Low
A vulnerability in the LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in Zephyr RTOS (subsys/lorawan/services/frag_transport.c) lacks validation of remaining payload bytes before each access. An attacker with session keys can cause an out-of-bounds read (up to ~232 bytes) past the RxPayload buffer, copying adjacent static memory into decoder buffers and the FUOTA flash image.
- CVE-2026-13213Medium
A vulnerability in the Hearing Access Service (HAS) in Zephyr RTOS allows a remote (Bluetooth) crash of the HAS peripheral. The issue occurs when a previously bonded client reconnects during the startup window before the application registers the service, leading to an assertion or NULL pointer dereference.
- CVE-2026-12633High
Vulnerability in IPv6 neighbor-discovery code (subsys/net/ip/ipv6_nbr.c) in Zephyr RTOS. The handle_ra_6co() function does not bound the context_len field from the 6CO option in Router Advertisements, leading to a buffer overflow and out-of-bounds memset. An attacker on the same link can send a crafted packet causing a system crash.
- CVE-2026-9771High
A vulnerability in the flash_copy() system call in Zephyr RTOS (with CONFIG_USERSPACE enabled) allows an unprivileged thread to pass forged pointers to flash device structures. Lack of device object validation (src_dev, dst_dev) before dereferencing enables arbitrary code execution in supervisor mode, leading to privilege escalation outside the userspace sandbox.
Original NVD description (English source)
The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop iteration it executed *handle = sqe, storing the kernel address of the newly acquired submission-queue entry through a pointer taken verbatim from user mode, with no K_SYSCALL_MEMORY_WRITE check in front of it. Any user-mode thread that has been granted a struct rtio kernel object can invoke the syscall with an arbitrary address in handle. That is the ordinary way an unprivileged thread uses the RTIO API, for example via sensor_read_async_mempool() or the async ADC helpers, which call rtio_sqe_copy_in_get_handles() internally. The store happens in supervisor mode before any submission-entry validation, so it fires regardless of whether the SQE contents are subsequently rejected. Only builds with CONFIG_USERSPACE and CONFIG_RTIO are affected; without CONFIG_USERSPACE the verifier is not compiled and the caller is already privileged. The write address is fully attacker-chosen and the written value is a pointer into the caller's own RTIO ring, whose contents the caller controls (the following *sqe = sqes[i] copies an attacker-supplied struct rtio_sqe into that slot). This yields a write-what-where primitive placing a pointer to attacker-controlled data at any kernel address, sufficient to corrupt kernel function pointers, thread structures, or memory-domain partition tables, and thus to escalate from user mode to kernel mode, defeating the isolation boundary CONFIG_USERSPACE is meant to enforce. At minimum it is a reliable kernel memory-corruption and crash primitive. The reporter reproduced the write on qemu_x86: a K_USER thread changed a supervisor global from NULL to a live kernel SQE pointer. The fix adds K_SYSCALL_MEMORY_WRITE(handle, sizeof(*handle)) (guarded by the existing optional-NULL semantics) before the loop, so the destination must lie in the calling thread's writable memory domain or the thread is terminated by K_OOPS. The neighbouring verifier z_vrfy_rtio_cqe_get_mempool_buffer(), which checked its buff/buff_len out-parameters only for read although the implementation writes through them, was hardened separately by bea93400138 ("rtio: syscalls: validate output params as writable"); that residual was materially weaker, since a read check still confines the target to the caller's own memory domain.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS