CVE-2026-9728

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A time-of-check/time-of-use (TOCTOU) race condition exists in the userspace syscall verifier z vrfy mbox send() within drivers/mbox/mbox handlers.c. The verifier validates the msg->data and msg->size fields by reading them from live userspace memory but then passes the original mutable pointer to z impl mbox send() and the driver. On systems built with CONFIG USERSPACE, an unprivileged thread can invoke the mbox send() system call while a second thread overwrites msg->data with a kernel address after the check but before the driver dereferences it. This allows the driver to read from an attacker-controlled address in supervisor context, leading to a userspace-to-supervisor access-control bypass. This can result in the disclosure of kernel memory contents or a denial of service if an invalid address is targeted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.