CVE-2026-19595

The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...