CVE-2026-87041

The RTIO submission-queue verifier rtiovrfysqe in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 accumulated the results of KSYSCALLMEMORY into its validsqe flag with &=. That macro returns nonzero on failure it is built on KSYSCALLVERIFYMSG, which yields !expr, so every buff...