The vulnerability exists in the userspace verifier function z_vrfy_rtio_sqe_copy_in_get_handles() in Zephyr's RTIO subsystem. The function validates the RTIO object handle and input array but does not validate the handle out-parameter before writing to it. This allows a user-mode thread with a struct rtio kernel object to supply an arbitrary address for the handle parameter, resulting in a write-what-where primitive that writes a kernel pointer to an attacker-chosen kernel address. This can corrupt kernel function pointers, thread structures, or memory-domain partition tables, enabling privilege escalation from user mode to kernel mode. The issue affects Zephyr versions >=3.4.0 and <4.4.2 with CONFIG_USERSPACE and CONFIG_RTIO enabled. The fix adds a K_SYSCALL_MEMORY_WRITE check on the handle parameter to ensure it is writable by the calling thread, preventing the exploit.

This vulnerability allows a user-mode thread with access to an RTIO kernel object to perform arbitrary kernel memory writes, potentially corrupting critical kernel data structures and enabling privilege escalation to kernel mode. It compromises the isolation boundary enforced by CONFIG_USERSPACE, leading to a high impact on confidentiality, integrity, and availability of the system. At minimum, it can cause reliable kernel crashes.

A fix is available that adds a K_SYSCALL_MEMORY_WRITE check on the handle parameter before the write operation. This ensures the destination address lies within the calling thread's writable memory domain, terminating the thread if not. Users should upgrade to Zephyr version 4.4.2 or later where this fix is included. Until then, avoid enabling both CONFIG_USERSPACE and CONFIG_RTIO simultaneously if possible.