User-Mode Validation Bypass in I3C Transfer Function of Zephyr RTOS

CVE-2026-87038

What is CVE-2026-87038?

The user-mode verification handler associated with the i3c_transfer() system call in Zephyr RTOS is vulnerable due to inadequate validation of the caller-supplied i3c_device_desc structure. The existing implementation validates the bus attribute by simply checking its read permission instead of creating a safe copy for subsequent operations. This oversight permits a user thread with access to rewrite the bus field of the descriptor while another thread processes the i3c_transfer(), leading to a race condition. If exploited successfully, this could allow an attacker to execute arbitrary kernel-mode code, bypassing the userspace memory protection mechanism, potentially resulting in unauthorized access or system crashes. A fix involving thorough validation of a kernel-local copy of the descriptor has been implemented to secure the system against this vulnerability.

References