CVE-2026-87038

A Time-of-check Time-of-use (TOCTOU) double fetch vulnerability exists in the Zephyr i3c_transfer() system call handler (z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c). The handler fails to snapshot the caller-supplied i3c_device_desc struct, instead validating it in place and passing a liv...