Zephyr Project up to 4.4.1 Syscall Verifier mbox_handlers.c z_vrfy_mbox_send data/size toctou

Summaryinfo

A vulnerability identified as problematic has been detected in Zephyr Project Zephyr up to 4.4.1. The affected element is the function z_vrfy_mbox_send of the file drivers/mbox/mbox_handlers.c of the component Syscall Verifier. The manipulation of the argument data/size leads to toctou. This vulnerability is uniquely identified as CVE-2026-9728. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Zephyr Project Zephyr up to 4.4.1. This issue affects the function z_vrfy_mbox_send of the file drivers/mbox/mbox_handlers.c of the component Syscall Verifier. The manipulation of the argument data/size with an unknown input leads to a toctou vulnerability. Using CWE to declare the problem leads to CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window. On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint). The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-9728 since 05/27/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 4.4.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• Zephyr Project

Name

• Zephyr

Version

• 4.4.0
• 4.4.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion