Is CVE-2026-19595 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19595 being exploited in the wild.

How severe is CVE-2026-19595?

Medium severity, with a CVSS score of 6.1, published 19 October 2026.

Which products and versions are affected?

Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE and CONFIG_RTIO_SYS_MEM_BLOCKS enabled.

How is CVE-2026-19595 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-19595?

Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19595: Zephyr RTIO syscall memory validation bypass

CVE-2026-19595 · Severity: medium · CVSS 6.1 · Published 2026-10-19

Zephyr's RTIO subsystem is a real-time I/O framework used for managing hardware memory pools in embedded systems. A vulnerability in the user-mode syscall verifier allows unprivileged threads with RTIO access to write to memory regions they should not be able to modify, potentially corrupting data or triggering a denial of service by crashing the device.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-19595 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19595 being exploited in the wild.
How severe is CVE-2026-19595?: Medium severity, with a CVSS score of 6.1, published 19 October 2026.
Which products and versions are affected?: Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE and CONFIG_RTIO_SYS_MEM_BLOCKS enabled.
Is there a fix for CVE-2026-19595?: No fixed version is recorded yet. Disable CONFIG_RTIO_SYS_MEM_BLOCKS or CONFIG_USERSPACE if RTIO memory pool block support is not required in user-mode applications, or restrict RTIO context access using rtio_access_grant() to only trusted threads. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19595 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-19595?: Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable CONFIG_RTIO_SYS_MEM_BLOCKS or CONFIG_USERSPACE if RTIO memory pool block support is not required in user-mode applications, or restrict RTIO context access using rtio_access_grant() to only trusted threads.

Technical details

The z_vrfy_rtio_cqe_get_mempool_buffer() syscall verifier incorrectly validates its output parameters (buff and buff_len) using K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(), allowing unprivileged user-mode threads with RTIO access to write through read-only pointers. An attacker can craft a completion-queue entry with controlled flags to perform kernel-mode stores to memory marked read-only for the thread, bypassing memory partition protections or causing kernel faults in globally unwritable regions like .text/.rodata. The fix replaces both checks with K_SYSCALL_MEMORY_WRITE() to properly enforce write permissions before the syscall implementation executes.

Affected products

Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE and CONFIG_RTIO_SYS_MEM_BLOCKS enabled

Timeline

2026-10-19: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.