CVE-2026-16511— Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
Quick assessment
Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 （在 v4.3.0 之前位于 ）中，存在两个 RTIO 系统调用验证函数，它们未在内核通过用户提供的指针进行写入前对该指针进行验证。 函数完全未执行任何验证。它直接将调用方提供的 指针传递给 。后者通过 宏将其转换为 ，并在内核态（supervisor mode）将其 16 位标志字段中按位或（OR）上 （即第 3 位， ），随后读取其 指针并重复该过程，直到该指针为 NULL。由于该系统调用不接受 RTIO 上下文参数，因此无需对象授权（object grant）：在启用了 的构建中，任意用户态线程均可在内存
Possible ATT&CK Techniques 3 AI
T1548 · Abuse Elevation Control Mechanism T1068 · Exploitation for Privilege Escalation T1212 · Exploitation for Credential Access
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16511
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
Source: CVE Program / CVE List V5
Vulnerability Description
Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them.
z_vrfy_rtio_sqe_cancel() performed no validation at all. It passed the caller's struct rtio_sqe pointer straight to z_impl_rtio_sqe_cancel(), which converts it with CONTAINER_OF to a struct rtio_iodev_sqe, ORs RTIO_SQE_CANCELED (BIT(3)) into its 16-bit flags field in supervisor mode, then loads its next pointer and repeats until that pointer is NULL. The syscall takes no RTIO context argument, so it needs no object grant: any user-mode thread on a CONFIG_USERSPACE build can set that bit in a 16-bit word at an address of its choosing in kernel memory, and the kernel continues the write along whatever pointer chain it finds at the corresponding offset. Setting chosen bits in kernel data structures, such as object permission or thread state fields, can be used to escalate privilege from user mode.
z_vrfy_rtio_sqe_copy_in_get_handles() validated its RTIO context and the input SQE array, but only NULL-checked the handle out-parameter before writing a kernel SQE pointer through it, with no K_SYSCALL_MEMORY_WRITE check. A user thread that holds a granted RTIO context can therefore make the kernel store a pointer value at an arbitrary address.
The fixes validate the handle out-parameter as writable, bound the cancel handle to real submission-pool storage, and require permission on the RTIO context that owns the matching pool. Without that last check a bounded handle still let any user thread cancel submissions belonging to other contexts, silently aborting their I/O. Systems built without CONFIG_USERSPACE or without CONFIG_RTIO are unaffected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
非可信指针解引用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zephyrproject | zephyr | 3.4.0 ~ 4.3.2 | - |
|
II. Public POCs for CVE-2026-16511
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16511
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-16511 (1)
Other References for CVE-2026-16511 (3)
Same Patch Batch · zephyrproject · 2026-11-04 · 8 CVEs total
| CVE-2026-87040 | 8.3 HIGH | Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured ma |
| CVE-2026-87039 | 7.8 HIGH | I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to |
| CVE-2026-87041 | 7.8 HIGH | Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to |
| CVE-2026-87038 | 7.0 HIGH | Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows |
| CVE-2026-87044 | 6.5 MEDIUM | Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely |
| CVE-2026-85036 | 5.7 MEDIUM | Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the sy |
| CVE-2026-87043 | 4.8 MEDIUM | sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready |
IV. Related Vulnerabilities
Same product: zephyr
-
CVE-2026-87044
Memory leak in the Mbed TLS crypto shim on failed cipher/AEA -
CVE-2026-87043
sys_rand_get() silently returns an unwritten buffer when the -
CVE-2026-87041
Inverted memory-permission check in the RTIO syscall verifie -
CVE-2026-87040
Bluetooth LE Controller accepts received PDUs whose length f -
CVE-2026-87039
I2S configure syscall handler passes an unvalidated user-sup
Same vendor: zephyrproject
-
CVE-2026-87044
Memory leak in the Mbed TLS crypto shim on failed cipher/AEA -
CVE-2026-87043
sys_rand_get() silently returns an unwritten buffer when the -
CVE-2026-87041
Inverted memory-permission check in the RTIO syscall verifie -
CVE-2026-87040
Bluetooth LE Controller accepts received PDUs whose length f -
CVE-2026-87039
I2S configure syscall handler passes an unvalidated user-sup
Same weakness: CWE-822
-
CVE-2026-88781
ASUS 主板固件：不可信指针解引用漏洞 -
CVE-2026-19676
PECI transfer syscall verifier does not validate embedded us -
CVE-2026-110322
HMS Networks PEAK-System PCAN Windows drivers Untrusted Poin -
CVE-2026-108435
Microsoft Office Word Information Disclosure Vulnerability -
CVE-2026-103578
Windows Kernel Elevation of Privilege Vulnerability