CVE-2026-87039

The user-mode syscall verifier z vrfy i2s configure() in drivers/i2s/i2s handlers.c copies the caller's struct i2s config in from user memory and then, when cfg->frame clk freq is 0 (the API's "unconfigure the stream" request), jumps straight to z impl i2s configure() without performing the K SYSCALL OBJ(config.mem slab, K OBJ MEM SLAB) ownership/type check or the block size sanity check. The mem slab field is a struct k mem slab *, so on that path a completely unvalidated, user-chosen pointer reaches driver code that is entitled to trust it as a real kernel object.

Any thread running under CONFIG USERSPACE that has access to an I2S device object can trigger this with a single i2s configure() call. Most in-tree drivers special-case frame clk freq == 0 and never store the caller's structure, but drivers/i2s/i2s litex.c does not: i2s litex configure() only logs a warning for a mismatched frame clock, then memcpy()s the caller's config into stream->cfg and marks the stream I2S STATE READY. A subsequent i2s trigger() with I2S TRIGGER START enables the FIFO interrupt, and the interrupt handlers i2s litex isr rx() / i2s litex isr tx() then call k mem slab alloc() and k mem slab free() on the attacker-supplied pointer in supervisor context.

The result is an arbitrary-pointer read/write primitive executed by the kernel on behalf of an unprivileged thread — k mem slab alloc() takes a spinlock at slab->lock and reads and writes slab->free list and the link word inside the returned "block" — which defeats the CONFIG USERSPACE isolation boundary entirely. The same missing validation is a hazard for out-of-tree I2S drivers that retain the configuration on the unconfigure path. Builds without CONFIG USERSPACE are unaffected, since the verifier is not used.

The fix zeroes config.mem slab and config.block size on the unconfigure path so the driver can never receive an unvalidated pointer, while still allowing a stream to be unconfigured by a caller that does not own a memory slab, as the API documents.