CVE-2026-87038

The user-mode verification handler for the i3ctransfer system call, zvrfyi3ctransfer in drivers/i3c/i3chandlers.c, validated the caller-supplied struct i3cdevicedesc in place instead of snapshotting it. It confirmed only that the descriptor was readable by the calling thread KSYSCALLMEMORYREAD,...

CVE-2026-87038

A Time-of-check Time-of-use (TOCTOU) double fetch vulnerability exists in the Zephyr i3c_transfer() system call handler (z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c). The handler fails to snapshot the caller-supplied i3c_device_desc struct, instead validating it in place and passing a liv...

CVE-2026-87038 Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode

The user-mode verification handler for the i3ctransfer system call, zvrfyi3ctransfer in drivers/i3c/i3chandlers.c, validated the caller-supplied struct i3cdevicedesc in place instead of snapshotting it. It confirmed only that the descriptor was readable by the calling thread KSYSCALLMEMORYREAD,...