User-mode syscall Verifier Vulnerability in Zephyr Project's I2S Driver

CVE-2026-87039

What is CVE-2026-87039?

The I2S driver in the Zephyr Project contains a vulnerability in the user-mode syscall verifier, specifically within the z_vrfy_i2s_configure() function. This issue arises when the configuration's frame clock frequency is set to zero during an unconfiguration request, leading to a bypass of essential ownership and sanity checks. An attacker can exploit this vulnerability by supplying an unvalidated pointer to a memory slab through a single i2s_configure() call. This can result in arbitrary memory reads and writes by the kernel, compromising system isolation and integrity. A patch has been implemented to address this by ensuring that unvalidated pointers cannot be passed to the driver.

References