CVE-2026-9728 in Zephyr
Summary
by MITRE • 08/24/2026
The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window.
On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint).
The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in the Zephyr real-time operating system involves a critical time-of-check to time-of-use (TOCTOU) flaw within the userspace syscall verifier for the mailbox subsystem. Specifically, the function z_vrfy_mbox_send located in drivers/mbox/mbox_handlers.c fails to properly isolate user-provided data from kernel execution context during validation. The original implementation reads fields such as msg->data and msg->size directly from live userspace memory to perform bounds checking. However, after this verification step completes, the system forwards a pointer to the mutable userspace struct mbox_msg * structure to z_impl_mbox_send() and subsequently to the underlying hardware driver. This architectural decision creates a race condition window where the validated data can be altered by another thread before it is actually consumed by the kernel or device driver.
In systems configured with CONFIG_USERSPACE, any unprivileged user-level thread has the ability to invoke the mbox_send system call. An attacker controlling multiple threads within the same address space can exploit this TOCTOU window through a carefully timed race condition. After the verifier successfully validates that msg->data points to an accessible userspace region and confirms its size is within acceptable limits, a second malicious thread can overwrite the msg->data pointer with a kernel-space or supervisor-mode memory address. Because the validation occurred on the original values but execution proceeds using the now-modified pointer, the system effectively bypasses access control checks that were intended to restrict user processes from reading privileged memory regions.
The operational impact of this vulnerability is severe and multifaceted. When the underlying driver attempts to read data from msg->data in supervisor context, it may inadvertently perform a kernel-mode read operation on an attacker-specified address. In scenarios where the overwritten pointer targets valid kernel memory, this results in a high-confidence disclosure of sensitive kernel information, effectively allowing unprivileged userspace code to exfiltrate privileged data. This constitutes a significant breach of confidentiality and violates fundamental isolation principles between user and supervisor modes. Furthermore, if the attacker specifies an invalid or unmapped address for msg->data, the subsequent dereference will trigger a fault in the kernel context, leading to a denial of service by crashing the system or disrupting critical services dependent on the mailbox subsystem.
This vulnerability aligns with CWE-367, which describes time-of-check-time-of-use (TOCTOU) race conditions, as well as CWE-200, concerning exposure of sensitive information to an unauthorized actor. From a threat modeling perspective using MITRE ATT&CK for IoT and embedded systems, this flaw facilitates privilege escalation via memory disclosure or denial of service through improper input validation and lack of atomicity in security-critical operations. The attack vector leverages the shared address space model common in many RTOS environments to bypass isolation boundaries that are typically enforced by hardware MMU protections when properly implemented at the syscall entry point.
The remediation strategy involves eliminating the race condition by ensuring that all user-provided data is safely copied into kernel-managed memory before any validation or usage occurs. The fix implements this by snapshotting the entire struct mbox_msg structure into a secure, immutable copy on the kernel stack using k_usermode_from_copy(). This function not only transfers the data from userspace to kernelspace but also ensures that subsequent operations operate on a static dataset that cannot be modified by other threads during execution. By validating and forwarding this isolated copy rather than the original mutable pointer, the system closes the TOCTOU window entirely. This approach enforces strict separation between user input validation and kernel processing, thereby restoring the integrity of access control mechanisms within the mailbox subsystem.