CVE-2026-12234

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description Userspace syscall verifiers z vrfy zsock sendmsg() and z vrfy zsock recvmsg() in subsys/net/lib/sockets/sockets.c contain a double-fetch Time-of-Check to Time-of-Use (TOCTOU) flaw. The issue occurs when the kernel snapshots a struct net msghdr but subsequently re-reads the live user structure for decision-making. Specifically, the kernel iovec shadow buffer is sized based on one read of msg->msg iovlen, while the population loop is bounded by a second read of the same field. A second thread can inflate msg->msg iovlen between these two reads, causing the loop to write iov base and iov len values beyond the allocated kernel-heap shadow buffer. This can be triggered by an unprivileged user thread when CONFIG USERSPACE is enabled and zsock sendmsg/zsock recvmsg syscalls are available, potentially leading to local privilege escalation or a kernel-fault denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.