Buffer Access Vulnerability in RTIO Submission Queue Verifier for Zephyr OS

CVE-2026-87041

What is CVE-2026-87041?

The RTIO submission-queue verifier in the Zephyr OS (specifically in the rtio_vrfy_sqe() function) allows attackers to bypass buffer permission checks due to a flaw in how syscall memory results are accumulated. This makes it possible for untrusted user-mode inputs to manipulate kernel memory, leading to unauthorized access or modification of data. The vulnerability can result in an attacker controlling which kernel memory regions are read or written, effectively escaping the intended isolation enforced by CONFIG_USERSPACE. The flaw primarily stems from an inversion in the buffer validation logic, where legitimate buffer checks failed to trigger correctly. A fix has been implemented that inverts the K_SYSCALL_MEMORY() results and enforces stricter buffer validation.

References