CVE-2026-87038

Name of the Vulnerable Software and Affected Versions Zephyr OS (affected versions not specified)

Description A race condition exists in the user-mode verification handler z vrfy i3c transfer() within the i3c transfer() system call. The handler validates the i3c device desc structure in place rather than creating a local copy. Because the implementation z impl i3c transfer() re-reads the target->bus variable from user memory, a second thread can modify this value after validation but before use. This Time-of-Check to Time-of-Use (TOCTOU) flaw allows an unprivileged user thread to force the kernel to dereference an attacker-controlled pointer and execute arbitrary code in supervisor mode, leading to a complete escape of the userspace memory-protection sandbox. This issue affects builds with CONFIG USERSPACE and an I3C controller driver.

Recommendations Update the software to a version where the i3c device desc descriptor is copied into a kernel-stack local using k usermode from copy() before validation and dispatch.