CVE-2026-19737: memory-safety in zephyrproject zephyr

The vulnerability exists in the i2s_esp32_trigger_check() function of the Zephyr OS i2s_esp32 driver. It improperly validates the direction argument only for I2S_DIR_BOTH, while I2S_DIR_RX and I2S_DIR_TX branches dereference stream pointers without null checks. When a device instance supports only one direction, the other direction's stream pointers are NULL, leading to a NULL pointer dereference on triggering that direction. This can be exploited by a user-mode thread with access to the I2S device on RISC-V SoCs with userspace enabled (starting in Zephyr v4.4.0). The resulting kernel-mode read at address zero causes an exception that halts the system, producing a denial of service. The flaw does not allow attacker-controlled memory writes or information leaks. The fix adds pointer validation and returns -ENOSYS for unsupported directions. The vulnerability is present from v4.4.0 to before v4.5.0; earlier versions have the code defect but are not affected due to lack of userspace support.

The vulnerability causes a denial of service by triggering a kernel-mode NULL pointer dereference when a user-mode thread issues an i2s_trigger() call with an unsupported direction. This results in a system halt due to an exception. There is no impact on confidentiality or integrity, as the flaw does not allow memory writes or information disclosure. Only availability is affected. The issue is limited to configurations with userspace enabled on certain RISC-V SoCs starting with Zephyr v4.4.0.

A fix is available that adds proper pointer checks in the i2s_esp32_trigger_check() function and returns an error (-ENOSYS) when an unsupported direction is requested. Users should upgrade to Zephyr version 4.5.0 or later where this fix is included. Until then, avoid running user-mode threads with access to the I2S device on affected versions. The driver's other entry points already guard against this issue. No additional mitigations are necessary.