User-Mode Syscall Verification Flaw in Zephyr RTOS Affects Memory Security

CVE-2026-19595

What is CVE-2026-19595?

In Zephyr RTOS, the user-mode syscall verifier employs incorrect validation for output parameters in the z_vrfy_rtio_cqe_get_mempool_buffer() function. Instead of using K_SYSCALL_MEMORY_WRITE(), it incorrectly uses K_SYSCALL_MEMORY_READ(). This oversight allows unprivileged threads, which hold access to an RTIO context, to potentially write to memory regions that should be read-only. When a syscall is invoked with user-controlled parameters, kernel code can execute a store operation in privileged mode, bypassing the intended memory protection. This could result in arbitrary values being written to memory segments marked as write-protected, or, in scenarios where an invalid write occurs, could lead to system crashes, denying service to legitimate users.

References