Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-9728— TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

驱动程序 中的用户态系统调用验证函数 通过直接从活跃的用户态内存中读取 和 字段来验证嵌套的消息结构。然而，该验证函数随后将原始的、仍可由用户态修改的 指针传递给了 及其底层的驱动程序。在访问检查完成与驱动程序实际使用 之间，存在一个时间差（TOCTOU），验证过的指针可能被替换，从而产生“检查时/使用时”（time-of-check/time-of-use）竞争条件窗口。 在启用了 配置的系统上，任何非特权的用户态线程均可调用 系统调用。如果存在第二个与调用者共享地址空间的线程，它可以在验证器完成边界检查之后、驱

CVSS 6.4 · Medium EPSS 0.08% · P0

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 3.0.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-9728

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
Source: CVE Program / CVE List V5
Vulnerability Description
The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window. On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint). The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.0.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-9728

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9728

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-9728 (1)

Vendor Advisories for CVE-2026-9728 (1)

Same Patch Batch · zephyrproject · 2026-08-24 · 4 CVEs total

CVE-2026-13212 8.8 HIGH Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring de
CVE-2026-13343 5.3 MEDIUM Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder
CVE-2026-13213 5.3 MEDIUM Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_re

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-367

V. Comments for CVE-2026-9728

No comments yet

Leave a comment