CVE-2026-19595: memory-safety in zephyrproject zephyr

The vulnerability exists in the user-mode syscall verifier function z_vrfy_rtio_cqe_get_mempool_buffer() within Zephyr's RTIO subsystem. The function incorrectly validates its output parameters buff and buff_len with a read permission check (K_SYSCALL_MEMORY_READ()) instead of a write permission check (K_SYSCALL_MEMORY_WRITE()). Since these parameters are used for kernel-mode stores, this allows an unprivileged user-mode thread, granted RTIO context access, to write to memory regions that are only read-accessible to that thread. This can lead to either bypassing memory domain write protections or triggering a kernel fault that halts or reboots the device. The vulnerability requires CONFIG_USERSPACE and CONFIG_RTIO_SYS_MEM_BLOCKS to be enabled. The fix replaces the read validation with write validation, causing threads lacking write permission to be terminated before the kernel-mode store occurs.

An attacker with unprivileged user-mode access to an RTIO context can cause kernel-mode writes to memory regions that should be read-only for that thread, bypassing memory domain write protections. Alternatively, if the target memory is globally readable but not writable (e.g., .text or .rodata sections), the kernel faults and triggers a fatal error handler, causing device halt or reboot. This results in a reliable denial of service. No confidential data disclosure or privilege escalation beyond write bypass is indicated.

A fix is available that replaces the incorrect read permission validation with proper write permission validation on the output parameters. This causes threads without write access to be terminated before kernel-mode writes occur. Users should apply the official patch or update to a fixed version. If no patch is immediately available, restricting unprivileged user-mode access to RTIO contexts and disabling CONFIG_RTIO_SYS_MEM_BLOCKS can mitigate exploitation. Patch status is not explicitly confirmed in the input; check the vendor advisory for current remediation guidance.