CVE-2026-87041

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.3.0

Description The submission-queue verifier rtio vrfy sqe() in subsys/rtio/rtio syscalls.c incorrectly processes buffer permission checks. Due to a logic error using the &= operator with the K SYSCALL MEMORY() macro, the verifier accepts buffers that are inaccessible to the calling thread and rejects legitimate thread-owned buffers. This issue affects images built with CONFIG USERSPACE and is triggered via the rtio sqe copy in get handles() system call or the rtio sqe copy in() wrapper.

An attacker with an RTIO context and an rtio iodev object can submit a crafted Submission Queue Element (SQE) pointing to arbitrary kernel memory. Because downstream handlers in I2C, I3C, and SPI drivers dereference these pointers with supervisor privileges, this can lead to:

This allows a complete escape from the user-mode isolation boundary.

Recommendations Update to version 4.3.0 or later. As a temporary mitigation, restrict the use of the rtio sqe copy in get handles() system call and the rtio sqe copy in() wrapper for untrusted user-mode threads.