CVE-2026-87041 in Zephyr
Summary
by MITRE • 11/04/2026
The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=. That macro returns nonzero on failure (it is built on K_SYSCALL_VERIFY_MSG(), which yields !(expr)), so every buffer permission check contributed the opposite of its result. A submission whose tx.buf, rx.buf or txrx.tx_buf/txrx.rx_buf pointer was not accessible to the calling thread was accepted, while a legitimate, thread-owned buffer caused the calling thread to be killed with a kernel oops.
The verifier runs on behalf of the rtio_sqe_copy_in_get_handles() system call (also reached through the inline rtio_sqe_copy_in() wrapper), so it is driven directly by untrusted user-mode input on any image built with CONFIG_USERSPACE. A user thread that has been granted an RTIO context and an rtio_iodev object — the intended usage of RTIO userspace support, established via rtio_access_grant() — can submit an SQE whose buffer pointer and length name arbitrary kernel memory; the object check on sqe->iodev is unaffected and still passes, and the crafted SQE is forwarded to the bus driver unchanged.
Downstream consumers dereference the pointer with supervisor privilege. The generic I2C and I3C RTIO fallback handlers (drivers/i2c/i2c_rtio_default.c, drivers/i3c/i3c_rtio_default.c) copy sqe.rx.buf/sqe.tx.buf into struct i2c_msg and call i2c_transfer(), and the vendor SPI/I2C RTIO drivers behave equivalently. An RTIO_OP_RX submission therefore has peripheral data written into kernel memory of the attacker's choosing (arbitrary kernel write), an RTIO_OP_TX submission clocks kernel memory out over the bus (kernel memory disclosure), and a pointer to unmapped memory faults the kernel. This is a full escape from the user-mode isolation boundary that CONFIG_USERSPACE exists to enforce.
The defect was masked for years because the in-tree user-mode RTIO tests only exercise RTIO_OP_NOP and mempool-backed reads, neither of which reaches the affected checks. The fix negates each K_SYSCALL_MEMORY() result and additionally validates the TXRX transmit buffer read-only, matching the SPI, I2C and I3C handlers.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability resides in the RTIO submission-queue verifier function rtio_vrfy_sqe within the Zephyr real-time operating system kernel subsystems. Specifically located in subsys/rtio/rtio_syscalls.c for versions prior to 4.3.0, this flaw stems from a critical logical error in how buffer permission checks are aggregated using the K_SYSCALL_MEMORY macro. This macro returns nonzero values upon failure and zero on success because it is built upon K_SYSCALL_VERIFY_MSG which yields the negation of its expression condition. The developer incorrectly used a bitwise AND assignment operator to accumulate these results into the valid_sqe flag, effectively inverting the logic such that successful permission checks resulted in invalid flags while failed checks were treated as valid. This inversion means that buffers not accessible to the calling thread are accepted by the kernel, whereas legitimate buffer accesses trigger fatal kernel oopses due to incorrect validation states being propagated through the system call handler chain.
This vulnerability is directly exploitable via untrusted user-mode input on any Zephyr image configured with CONFIG_USERSPACE support. The verifier operates as part of the rtio_sqe_copy_in_get_handles system call, which can be invoked by applications granted an RTIO context and associated device objects through standard access grant mechanisms. An attacker possessing these privileges can craft a submission queue entry that specifies arbitrary kernel memory addresses for transmission or reception buffers. Because the object check on the I/O device remains unaffected and passes validation, the maliciously crafted submission is forwarded unchanged to the underlying bus drivers without proper boundary enforcement. This represents a fundamental breakdown in the isolation model intended by CONFIG_USERSPACE, allowing user-space processes to bypass standard memory protection mechanisms through logical inversion rather than complex exploitation techniques.
The operational impact of this flaw enables severe security violations including arbitrary kernel memory writes and disclosures depending on the operation type specified in the submission queue entry. For receive operations, peripheral hardware data is written directly into kernel memory at addresses chosen by the attacker, constituting an arbitrary kernel write vulnerability that can lead to full system compromise or privilege escalation. Conversely, transmit operations allow the attacker to clock out contents of kernel memory over physical buses such as I2C, SPI, or I3C, resulting in sensitive information disclosure. Additionally, submissions pointing to unmapped memory cause immediate kernel faults and denial of service conditions. These capabilities effectively constitute a complete escape from user-mode isolation boundaries, allowing unprivileged applications to interact with privileged kernel structures and hardware peripherals without restriction.
The defect remained undetected for extended periods because existing test suites only exercised operations like RTIO_OP_NOP and mempool-backed reads which do not trigger the affected validation logic paths. The resolution involves correcting the logical inversion by negating each K_SYSCALL_MEMORY result before aggregation and ensuring that transmit buffers are validated as read-only, aligning with security expectations established in SPI, I2C, and I3C driver implementations. From a classification perspective this vulnerability maps to CWE-691 which describes use of unintentional address aliasing or similar logical errors leading to improper access control. In terms of attack vectors it aligns with ATT&CK techniques involving privilege escalation through kernel exploitation and data exfiltration via hardware bus interfaces, highlighting the critical importance of rigorous validation logic in system call handlers that bridge user-space applications with privileged driver subsystems.