CVE-2026-87041

The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (prior to v4.3.0) contains an inverted memory-permission check. Because the verifier incorrectly used bitwise AND (&=) to accumulate results from K_SYSCALL_MEMORY(), it accepted pointers that were not accessible to ...