CVE-2026-16511

Name of the Vulnerable Software and Affected Versions RTIO versions prior to 4.3.0

Description Two RTIO syscall verifiers in subsys/rtio/rtio syscalls.c fail to validate user-supplied pointers before the kernel writes through them. The function z vrfy rtio sqe cancel() performs no validation, allowing a user-mode thread on a CONFIG USERSPACE build to set a specific bit in a 16-bit word at an arbitrary address in kernel memory, which can lead to privilege escalation. Additionally, the function z vrfy rtio sqe copy in get handles() only performs a NULL-check on the handle out-parameter without a K SYSCALL MEMORY WRITE check, enabling a user thread with a granted RTIO context to force the kernel to store a pointer value at an arbitrary address.

Recommendations Update to version 4.3.0 or later. As a temporary mitigation, restrict access to the z vrfy rtio sqe cancel() and z vrfy rtio sqe copy in get handles() functions.