32 matches found
CVE-2026-87041
The RTIO submission-queue verifier rtiovrfysqe in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 accumulated the results of KSYSCALLMEMORY into its validsqe flag with &=. That macro returns nonzero on failure it is built on KSYSCALLVERIFYMSG, which yields !expr, so every buff...
CVE-2026-16511
Two RTIO syscall verifiers, in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0, did not validate user-supplied pointers before the kernel wrote through them. zvrfyrtiosqecancel performed no validation at all. It passed the caller's struct rtiosqe pointer straight to...
CVE-2026-87041 Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory
The RTIO submission-queue verifier rtiovrfysqe in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 accumulated the results of KSYSCALLMEMORY into its validsqe flag with &=. That macro returns nonzero on failure it is built on KSYSCALLVERIFYMSG, which yields !expr, so every buff...
CVE-2026-87041
The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (prior to v4.3.0) contains an inverted memory-permission check. Because the verifier incorrectly used bitwise AND (&=) to accumulate results from K_SYSCALL_MEMORY(), it accepted pointers that were not accessible to ...
CVE-2026-87041 Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory
The RTIO submission-queue verifier rtiovrfysqe in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 accumulated the results of KSYSCALLMEMORY into its validsqe flag with &=. That macro returns nonzero on failure it is built on KSYSCALLVERIFYMSG, which yields !expr, so every buff...
CVE-2026-16511 Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
Two RTIO syscall verifiers, in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0, did not validate user-supplied pointers before the kernel wrote through them. zvrfyrtiosqecancel performed no validation at all. It passed the caller's struct rtiosqe pointer straight to...
CVE-2026-16511 Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
Two RTIO syscall verifiers, in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0, did not validate user-supplied pointers before the kernel wrote through them. zvrfyrtiosqecancel performed no validation at all. It passed the caller's struct rtiosqe pointer straight to...
CVE-2026-16511
The Zephyr RTOS kernel is vulnerable to memory corruption via two RTIO syscall verifiers in subsys/rtio/rtio_syscalls.c (or subsys/rtio/rtio_handlers.c before v4.3.0). The z_vrfy_rtio_sqe_cancel() function fails to validate user-supplied pointers, allowing a user-mode thread on a CONFIG_USERSPACE...
CVE-2026-79978
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978 Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
EUVD-2026-109141
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978
The ADXL345 sensor driver in Zephyr contains an out-of-bounds write vulnerability in the adxl345_process_fifo_samples_cb() callback within drivers/sensor/adi/adxl345/adxl345_stream.c. The root cause is that the driver calculates buffer offsets based on hardware-reported FIFO entries rather than t...
CVE-2026-79978 Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978 Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
PT-2026-122212
The RTIO streaming completion callback adxl345 process fifo samples cb in drivers/sensor/adi/adxl345/adxl345 stream.c clamps the amount of FIFO data it will report read len = MINfifo bytes, buf avail to the space actually returned by rtio sqe rx buf, but then queues one 6-byte bus read per hardwa...
PT-2026-120775
The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data ready work handler drivers/sensor/broadcom/afbr s50/afbr s50.c, a non-STATUS OK return from Argus EvaluateData calls handle error on result, which finalises the reques...
CVE-2026-19595
The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...
EUVD-2026-104665
The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...