# CVE-2026-16511: Zephyr RTIO syscall verifier privilege escalation

Source: https://junglewise.ai/threats/cve-2026-16511-two-rtio-syscall-verifiers-in-subsys-rtio-rtio-syscalls-c-subsys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-16511 · Severity: high · CVSS 8.8 · Published 2026-11-04

Zephyr is an open-source real-time operating system kernel. Two syscall handlers in the RTIO (Real-time I/O) subsystem fail to properly validate user-supplied memory pointers before writing to them. An attacker can exploit this to write arbitrary values to kernel memory, potentially escalating privileges from user mode to kernel mode or causing denial of service.

Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-16511 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16511 being exploited in the wild.

**How severe is CVE-2026-16511?** High severity, with a CVSS score of 8.8, published 4 November 2026.

**Which products and versions are affected?** Zephyr before v4.3.0.

**Is there a fix for CVE-2026-16511?** Yes: fixed in Zephyr v4.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16511 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-16511?** Check whether you run Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Zephyr v4.3.0

## Technical details

The z_vrfy_rtio_sqe_cancel() verifier passes an unvalidated user-mode pointer directly to the kernel implementation, which writes a flag bit and follows a pointer chain in kernel space without bounds checking. The z_vrfy_rtio_sqe_copy_in_get_handles() verifier lacks proper K_SYSCALL_MEMORY_WRITE validation of its output parameter before writing a kernel pointer through it. Both vulnerabilities require CONFIG_USERSPACE to be enabled; exploitation allows privilege escalation or context-based denial of service.

## Affected products

- Zephyr Zephyr before v4.3.0

## Timeline

- 2026-11-04: disclosed