CVE-2026-87038

The user-mode verification handler for the i3ctransfer system call, zvrfyi3ctransfer in drivers/i3c/i3chandlers.c, validated the caller-supplied struct i3cdevicedesc in place instead of snapshotting it. It confirmed only that the descriptor was readable by the calling thread KSYSCALLMEMORYREAD,...