CVE-2026-19676 PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

The user-mode verifier for the pecitransfer system call, zvrfypecitransfer in drivers/peci/pecihandlers.c, checked only the device object permission and copied the caller-supplied struct pecimsg with kusermodefromcopy. That copy validates the outer structure only; the buf pointers and len values...

CVE-2026-19676

The peci_transfer() system call in the Zephyr RTOS (specifically within drivers/peci/peci_handlers.c ) fails to properly validate embedded buffer pointers and length values in the peci_msg structure. While the verifier checks outer structure permissions, it allows caller-controlled pointers in th...

CVE-2026-19676 PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

The user-mode verifier for the pecitransfer system call, zvrfypecitransfer in drivers/peci/pecihandlers.c, checked only the device object permission and copied the caller-supplied struct pecimsg with kusermodefromcopy. That copy validates the outer structure only; the buf pointers and len values...