8 matches found
CVE-2026-19595
The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...
CVE-2026-19595
The Zephyr RTOS contains a vulnerability in the RTIO syscall verifier located in subsys/rtio/rtio_syscalls.c. The function z_vrfy_rtio_cqe_get_mempool_buffer() incorrectly validates the output parameters buff and buff_len using K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(). Because ...
EUVD-2026-104665
The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...
CVE-2026-19595 Zephyr RTIO syscall verifier validates output parameters for read instead of write access
The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...
CVE-2026-19595
The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...
CVE-2026-19595 Zephyr RTIO syscall verifier validates output parameters for read instead of write access
The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...
CVE-2026-19595 Zephyr RTIO syscall verifier validates output parameters for read instead of write access
The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...
PT-2026-117695
Name of the Vulnerable Software and Affected Versions Zephyr OS affected versions not specified Description An issue exists in the user-mode syscall verifier z vrfy rtio cqe get mempool buffer within subsys/rtio/rtio syscalls.c. The verifier incorrectly uses K SYSCALL MEMORY READ instead of K...