Userspace-to-Supervisor Access Control Bypass in Zephyr OS

CVE-2026-9728

What is CVE-2026-9728?

A vulnerability exists in the userspace syscall verifier for the mbox_send() function within Zephyr OS. This flaw allows unprivileged threads to manipulate shared memory, leading to potential disclosures of sensitive kernel memory. Through a race condition, an attacker can overwrite the message data before the driver processes it, resulting in either the leakage of kernel contents or a denial of service due to faulty memory access. To mitigate this risk, the system now employs a method to snapshot the mbox_msg structure in a secure manner, ensuring that only validated, immutable data is utilized post-verification.

References