CVE-2026-16511

The Zephyr RTOS kernel is vulnerable to memory corruption via two RTIO syscall verifiers in subsys/rtio/rtio_syscalls.c (or subsys/rtio/rtio_handlers.c before v4.3.0). The z_vrfy_rtio_sqe_cancel() function fails to validate user-supplied pointers, allowing a user-mode thread on a CONFIG_USERSPACE...