CVE-2026-16513: Zephyr RTIO userspace verifier write-what-where in rtio_sqe_copy_in_get_handles()

CVE-2026-16513 · Severity: high · CVSS 7.8 · Published 2026-09-28

Zephyr's RTIO (Realtime I/O) subsystem is used to manage asynchronous hardware operations like sensor reads and ADC conversions. A flaw in the userspace API boundary allows any unprivileged thread with access to an RTIO object to write a kernel pointer to an arbitrary memory address. An attacker can exploit this to corrupt kernel data structures and escalate privileges from user mode to kernel mode, bypassing the CONFIG_USERSPACE isolation mechanism.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-16513 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-16513 being exploited in the wild.
How severe is CVE-2026-16513?
High severity, with a CVSS score of 7.8, published 28 September 2026.
Which products and versions are affected?
Zephyr Project Zephyr RTOS before v4.3.0.
Is there a fix for CVE-2026-16513?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16513 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-16513?
Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The z_vrfy_rtio_sqe_copy_in_get_handles() syscall verifier failed to validate that the handle out-parameter points to writable user memory before writing a kernel SQE pointer to it. An attacker provides an arbitrary kernel address, which is dereferenced in supervisor mode without a K_SYSCALL_MEMORY_WRITE() guard. The write value is attacker-controlled (contents of the caller's own RTIO ring), yielding a write-what-where primitive to corrupt kernel function pointers or thread structures. The fix adds the missing memory validation check before the loop.

Affected products

  • Zephyr Project Zephyr RTOS before v4.3.0

Timeline

  • 2026-09-28: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.