CVE-2026-19185

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description In CONFIG USERSPACE builds, the system-call verifier for i3c do ccc() in drivers/i3c/i3c handlers.c fails to validate per-target data buffers within the i3c ccc target payload structure. Specifically, the data pointer and data len are not processed through K SYSCALL MEMORY() before being passed to z impl i3c do ccc() and the controller driver. Additionally, the verifier uses the caller's live structure instead of a snapshot, allowing a second user thread to modify validated fields between the check and the driver's execution. An unprivileged user-mode thread with access to the I3C controller device object can provide an arbitrary kernel address as a target payload data pointer. This allows a read CCC to write bus-received bytes into an attacker-chosen kernel address or a write CCC to transmit kernel memory onto the I3C bus, leading to out-of-bounds kernel write and kernel memory disclosure, which can result in privilege escalation to supervisor level.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.