CVE-2026-19595

The user-mode syscall verifier z vrfy rtio cqe get mempool buffer() in subsys/rtio/rtio syscalls.c validated its two output parameters, buff and buff len, with K SYSCALL MEMORY READ() rather than K SYSCALL MEMORY WRITE(). Both are pure out-parameters: z impl rtio cqe get mempool buffer() stores the mempool buffer address and its length through them. The distinction is enforced by every architecture validator — arch buffer validate() on RISC-V PMP explicitly accepts the global rom region/ rodata region for reads only, and the ARM MPU validators accept P RO U RO and P RW U RO regions for reads only — so a read-validated pointer is not necessarily writable by the calling thread.

An unprivileged user-mode thread that has been granted access to an RTIO context (rtio access grant()) can invoke the rtio cqe get mempool buffer() syscall with buff/buff len pointing at memory it may read but not write, and with a completion-queue entry whose flags field it fully controls (only RTIO CQE FLAG MEMPOOL BUFFER in flags[7:0] is required; flags[19:8] and flags[31:20] supply the block index and count). The kernel then performs a pointer-sized and a 4-byte store through those addresses while running in supervisor mode. Reaching the store requires CONFIG USERSPACE together with CONFIG RTIO SYS MEM BLOCKS, the configuration behind RTIO DEFINE WITH MEMPOOL; without the latter the implementation returns -ENOTSUP and writes nothing.

Two outcomes follow. If the target lies in a memory-domain partition declared K MEM PARTITION P RW U RO (privileged read-write, user read-only), the kernel-mode store succeeds and deposits partly attacker-chosen values into memory the memory domain had marked read-only for that thread, bypassing the partition's write protection. If the target lies in globally readable but unwritable memory such as .text/.rodata in flash, the store faults in kernel mode; the fault is delivered to z fatal error() and the default k sys fatal error handler() halts or reboots the device, giving an unprivileged thread a reliable full denial of service.

The read-permission check does bound the damage: the address must still be readable by the calling thread, so kernel-private memory cannot be targeted and no confidential data is disclosed. The fix replaces both checks with K SYSCALL MEMORY WRITE(), so a thread lacking write permission is terminated by K OOPS before the implementation runs; the cqe argument correctly remains read-validated.