# CVE-2026-19595: Zephyr RTIO syscall memory validation bypass

Source: https://junglewise.ai/threats/cve-2026-19595-the-user-mode-syscall-verifier-z-vrfy-rtio-cqe-get-mempool-buffer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-19595 · Severity: medium · CVSS 6.1 · Published 2026-10-19

Zephyr's RTIO subsystem is a real-time I/O framework used for managing hardware memory pools in embedded systems. A vulnerability in the user-mode syscall verifier allows unprivileged threads with RTIO access to write to memory regions they should not be able to modify, potentially corrupting data or triggering a denial of service by crashing the device.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-19595 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19595 being exploited in the wild.

**How severe is CVE-2026-19595?** Medium severity, with a CVSS score of 6.1, published 19 October 2026.

**Which products and versions are affected?** Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE and CONFIG_RTIO_SYS_MEM_BLOCKS enabled.

**Is there a fix for CVE-2026-19595?** No fixed version is recorded yet. Disable CONFIG_RTIO_SYS_MEM_BLOCKS or CONFIG_USERSPACE if RTIO memory pool block support is not required in user-mode applications, or restrict RTIO context access using rtio_access_grant() to only trusted threads. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19595 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-19595?** Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable CONFIG_RTIO_SYS_MEM_BLOCKS or CONFIG_USERSPACE if RTIO memory pool block support is not required in user-mode applications, or restrict RTIO context access using rtio_access_grant() to only trusted threads.

## Technical details

The z_vrfy_rtio_cqe_get_mempool_buffer() syscall verifier incorrectly validates its output parameters (buff and buff_len) using K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(), allowing unprivileged user-mode threads with RTIO access to write through read-only pointers. An attacker can craft a completion-queue entry with controlled flags to perform kernel-mode stores to memory marked read-only for the thread, bypassing memory partition protections or causing kernel faults in globally unwritable regions like .text/.rodata. The fix replaces both checks with K_SYSCALL_MEMORY_WRITE() to properly enforce write permissions before the syscall implementation executes.

## Affected products

- Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE and CONFIG_RTIO_SYS_MEM_BLOCKS enabled

## Timeline

- 2026-10-19: disclosed

## Related threats

- [Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a)
- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random)
- [Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter)
- [Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not)