CVE-2026-19737

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.4.0 through 4.4.x

Description A NULL pointer dereference exists in the I2S driver for Espressif devices. The function i2s esp32 trigger check() in drivers/i2s/i2s esp32.c fails to validate stream pointers for the I2S DIR RX and I2S DIR TX branches. When a device is configured for only one direction, attempting to trigger the unused direction leads to a memory load from address 0 in kernel mode. In builds with CONFIG USERSPACE enabled, such as on RISC-V SoCs with CONFIG RISCV PMP, an unprivileged user-mode thread with access to the I2S device can call the i2s trigger() syscall with an invalid direction to cause a system-wide denial of service. The issue is triggered via the dir parameter passed to the i2s trigger() syscall.

Recommendations Update Zephyr to a version where the pointer check has been implemented in i2s esp32 trigger check() to return -ENOSYS for unimplemented directions. As a temporary workaround, restrict user-mode access to the I2S device or avoid calling i2s trigger() with directions not explicitly defined in the devicetree.