CVE-2026-16511— RTIO 系统调用验证器未验证用户指针漏洞
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 （在 v4.3.0 之前位于 ）中，存在两个 RTIO 系统调用验证函数，它们未在内核通过用户提供的指针进行写入前对该指针进行验证。 函数完全未执行任何验证。它直接将调用方提供的 指针传递给 。后者通过 宏将其转换为 ，并在内核态（supervisor mode）将其 16 位标志字段中按位或（OR）上 （即第 3 位， ），随后读取其 指针并重复该过程，直到该指针为 NULL。由于该系统调用不接受 RTIO 上下文参数，因此无需对象授权（object grant）：在启用了 的构建中，任意用户态线程均可在内存
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-16511 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
来源: CVE Program / CVE List V5
Vulnerability Description
Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them.
z_vrfy_rtio_sqe_cancel() performed no validation at all. It passed the caller's struct rtio_sqe pointer straight to z_impl_rtio_sqe_cancel(), which converts it with CONTAINER_OF to a struct rtio_iodev_sqe, ORs RTIO_SQE_CANCELED (BIT(3)) into its 16-bit flags field in supervisor mode, then loads its next pointer and repeats until that pointer is NULL. The syscall takes no RTIO context argument, so it needs no object grant: any user-mode thread on a CONFIG_USERSPACE build can set that bit in a 16-bit word at an address of its choosing in kernel memory, and the kernel continues the write along whatever pointer chain it finds at the corresponding offset. Setting chosen bits in kernel data structures, such as object permission or thread state fields, can be used to escalate privilege from user mode.
z_vrfy_rtio_sqe_copy_in_get_handles() validated its RTIO context and the input SQE array, but only NULL-checked the handle out-parameter before writing a kernel SQE pointer through it, with no K_SYSCALL_MEMORY_WRITE check. A user thread that holds a granted RTIO context can therefore make the kernel store a pointer value at an arbitrary address.
The fixes validate the handle out-parameter as writable, bound the cancel handle to real submission-pool storage, and require permission on the RTIO context that owns the matching pool. Without that last check a bounded handle still let any user thread cancel submissions belonging to other contexts, silently aborting their I/O. Systems built without CONFIG_USERSPACE or without CONFIG_RTIO are unaffected.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
非可信指针解引用
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 3.4.0 ~ 4.3.2 | - |
|
二、漏洞 CVE-2026-16511 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-16511 的情报信息
请登录查看更多情报信息。
CVE-2026-16511 补丁与修复 (1)
CVE-2026-16511 其他参考 (3)
同批安全公告 · zephyrproject · 2026-11-04 · 共 8 条
| CVE-2026-87040 | 8.3 HIGH | 蓝牙 LE 控制器越界读写漏洞 |
| CVE-2026-87039 | 7.8 HIGH | I2S 配置系统调用处理程序远程代码执行漏洞 |
| CVE-2026-87041 | 7.8 HIGH | RTIO 系统调用验证器内存权限检查反转漏洞 |
| CVE-2026-87038 | 7.0 HIGH | Zephyr i3c_transfer() 竞态条件导致内核控制流劫持漏洞 |
| CVE-2026-87044 | 6.5 MEDIUM | Mbed TLS 加密组件远程拒绝服务漏洞 |
| CVE-2026-85036 | 5.7 MEDIUM | 蓝牙 AVDTP 会话重用导致系统工作队列损坏漏洞 |
| CVE-2026-87043 | 4.8 MEDIUM | glibc sys_rand_get 熵设备未就绪时返回未写缓冲区漏洞 |