CVE-2026-87039
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in the Zephyr RTOS syscall verifier z_vrfy_i2s_configure() skips the K_SYSCALL_OBJ ownership/type check for config.mem_slab and the block_size sanity check when frame_clk_freq is 0. As a result, an unprivileged thread under CONFIG_USERSPACE can supply an arbitrary pointer that reaches driver code (e.g., i2s_litex) and is used in supervisor context by k_mem_slab_alloc()/k_mem_slab_free().
Risk Assessment
This gives an unprivileged thread an arbitrary-pointer read/write primitive executed by the kernel, completely defeating the CONFIG_USERSPACE isolation boundary and potentially leading to privilege escalation or system instability.
Recommendation
Update Zephyr RTOS to a version containing the fix that zeroes config.mem_slab and config.block_size on the unconfigure path. If updating is not possible, restrict unprivileged thread access to I2S device objects or disable CONFIG_USERSPACE for applications using I2S.
Other vulnerabilities in Zephyr RTOS
See all- CVE-2026-90585Medium
The Renesas RA SCI UART driver in Zephyr does not acknowledge the receive-error condition in uart_ra_sci_eri_isr() when no callback is registered (data->user_cb is NULL). The SCI error flags remain set and the ICU interrupt flag is never cleared, causing the ISR to re-pend immediately and re-enter endlessly. This occurs with CONFIG_UART_INTERRUPT_DRIVEN=y and CONFIG_UART_ASYNC_API=n when the error interrupt is unmasked by uart_configure() or uart_irq_err_enable().
- CVE-2026-87043Medium
In the entropy-device random number generator (subsys/random/random_entropy_device.c), rand_get() returned early with -ENODEV when device_is_ready() failed, bypassing the non-cryptographic system-timer fallback. Because sys_rand_get() and sys_rand32_get() return void and cannot report failure, the caller's output buffer was left untouched and its previous (uninitialized) contents were returned as random data. The not-ready state is a normal runtime condition (e.g., early initialization) or a permanent result of an entropy driver init failure.
- CVE-2026-87041High
A vulnerability in the RTIO submission-queue verifier rtio_vrfy_sqe() in Zephyr RTOS stems from incorrectly combining K_SYSCALL_MEMORY() results with &=; since the macro returns nonzero on failure, buffer permission checks were inverted. Inaccessible buffers were accepted while legitimate thread-owned buffers caused a kernel oops. This allows user threads with an RTIO context to write to arbitrary kernel memory, disclose it, or fault the kernel, bypassing CONFIG_USERSPACE isolation.
- CVE-2026-16511High
Two RTIO syscall verifiers in Zephyr RTOS failed to properly validate user-supplied pointers before the kernel wrote through them. z_vrfy_rtio_sqe_cancel() performed no validation at all, allowing a user-mode thread to set chosen bits in kernel memory, while z_vrfy_rtio_sqe_copy_in_get_handles() wrote a kernel pointer to an arbitrary address without a write-permission check. Only systems built with CONFIG_USERSPACE and CONFIG_RTIO are affected.
- CVE-2026-82962Medium
A vulnerability in ethernet_fill_header() in the Zephyr RTOS network stack prepends the Ethernet header in place via net_buf_push without verifying that the packet has sufficient headroom. Packets allocated by a different L2 (e.g., 802.15.4/OpenThread, PPP) and handed to Ethernet through routing or tunnelling have too little (usually zero) headroom, causing an out-of-bounds write. In builds without CONFIG_ASSERT and CONFIG_NET_BUF_HARDENING this results in memory corruption.
- CVE-2026-19595Medium
A vulnerability in the Zephyr RTOS syscall verifier: z_vrfy_rtio_cqe_get_mempool_buffer() validated its output parameters buff and buff_len with K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(). This allows an unprivileged user-mode thread to invoke the syscall with pointers to read-only memory, causing a supervisor-mode store outside the permitted region or a kernel fault that halts or reboots the device.
- CVE-2026-19940Medium
A vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) implementation in Zephyr RTOS causes corruption of the kernel timeout list. By sending AT+CIND? and quickly reconnecting, a remote attacker can trigger a system-wide fault or hang.
- CVE-2026-19736High
The NXP MCUX TRNG entropy driver in Zephyr (drivers/entropy/entropy_mcux_trng.c) passes the caller's byte count directly to the SDK routine TRNG_GetRandomData(), which on i.MX RT5xx/RT6xx parts always copies whole 32-bit words and rounds entropy draws up to a multiple of 128 bytes. A request length not a multiple of four causes an underflow in the SDK's buffer-full check, leading to an overflow of up to 127 bytes past the caller's buffer.
- CVE-2026-19575High
A vulnerability in Zephyr RTOS affects the user-mode verification handler z_vrfy_device_deinit() in kernel/device.c, which validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). Because k_object_validate() short-circuits type comparison for K_OBJ_ANY, the check only verified that the pointer was the base address of some kernel object the calling thread was granted, without comparing the object's actual type. This allows a local user-mode thread to pass a thread stack object (e.g., from k_thread_stack_alloc()) and achieve supervisor-mode kernel code execution.
- CVE-2026-19574High
In the ARM64 MMU back-end of Zephyr RTOS, address space identifiers (ASIDs) are assigned by a bare round-robin counter, which after wrapping past 255 possible values can hand the same ASID to a new domain while a still-live domain holds it. Because domain-private mappings are installed as non-global (MT_NG), the ASID is the only tag separating cached translations in the TLB, and the context-switch path does not flush the TLB for a duplicate reached through a third domain. As a result, user-mode threads in one domain can read and write memory belonging to another domain, defeating memory-domain isolation.
Original NVD description (English source)
The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i2s_handlers.c copies the caller's struct i2s_config in from user memory and then, when cfg->frame_clk_freq is 0 (the API's "unconfigure the stream" request), jumps straight to z_impl_i2s_configure() without performing the K_SYSCALL_OBJ(config.mem_slab, K_OBJ_MEM_SLAB) ownership/type check or the block_size sanity check. The mem_slab field is a struct k_mem_slab *, so on that path a completely unvalidated, user-chosen pointer reaches driver code that is entitled to trust it as a real kernel object. Any thread running under CONFIG_USERSPACE that has access to an I2S device object can trigger this with a single i2s_configure() call. Most in-tree drivers special-case frame_clk_freq == 0 and never store the caller's structure, but drivers/i2s/i2s_litex.c does not: i2s_litex_configure() only logs a warning for a mismatched frame clock, then memcpy()s the caller's config into stream->cfg and marks the stream I2S_STATE_READY. A subsequent i2s_trigger() with I2S_TRIGGER_START enables the FIFO interrupt, and the interrupt handlers i2s_litex_isr_rx() / i2s_litex_isr_tx() then call k_mem_slab_alloc() and k_mem_slab_free() on the attacker-supplied pointer in supervisor context. The result is an arbitrary-pointer read/write primitive executed by the kernel on behalf of an unprivileged thread — k_mem_slab_alloc() takes a spinlock at slab->lock and reads and writes slab->free_list and the link word inside the returned "block" — which defeats the CONFIG_USERSPACE isolation boundary entirely. The same missing validation is a hazard for out-of-tree I2S drivers that retain the configuration on the unconfigure path. Builds without CONFIG_USERSPACE are unaffected, since the verifier is not used. The fix zeroes config.mem_slab and config.block_size on the unconfigure path so the driver can never receive an unvalidated pointer, while still allowing a stream to be unconfigured by a caller that does not own a memory slab, as the API documents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS