# CVE-2026-19737: Zephyr i2s_esp32 null pointer dereference in trigger validation

Source: https://junglewise.ai/threats/cve-2026-19737-i2s-esp32-trigger-check-in-drivers-i2s-i2s-esp32-c-validates-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19737 · Severity: medium · CVSS 5.5 · Published 2026-10-11

Zephyr's ESP32 I2S driver incorrectly validates the direction parameter in trigger operations, allowing a user-mode thread with I2S device access to cause a null pointer read in kernel mode. On systems with userspace enabled, this can crash the entire system. The vulnerability is limited to denial of service; there is no data exposure or code execution risk.

Technologies: [Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-zephyr-os). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19737 being exploited in the wild.

**How severe is CVE-2026-19737?** Medium severity, with a CVSS score of 5.5, published 11 October 2026.

**Which products and versions are affected?** Zephyr OS v4.4.0 and later (userspace-enabled builds with RISC-V PMP on ESP32-C6 or ESP32-C5).

**Is there a fix for CVE-2026-19737?** No fixed version is recorded yet. Disable CONFIG_USERSPACE on affected Espressif platforms, or restrict I2S device permissions to trusted kernel code only. The fix validates stream pointers for all direction values before dereferencing them.</anigation>
<parameter name="fixed_in">Zephyr v4.4.1 and later; backported to v4.3-branch If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19737 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-19737?** Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable CONFIG_USERSPACE on affected Espressif platforms, or restrict I2S device permissions to trusted kernel code only. The fix validates stream pointers for all direction values before dereferencing them.</anigation>
<parameter name="fixed_in">Zephyr v4.4.1 and later; backported to v4.3-branch

## Technical details

The i2s_esp32_trigger_check() function in drivers/i2s/i2s_esp32.c fails to validate stream pointers when the I2S_DIR_RX or I2S_DIR_TX direction is specified, only performing the check for I2S_DIR_BOTH. On single-direction I2S instances, this leads to a read from address 0 when an unwanted direction is triggered. The vulnerability is reachable via the i2s_trigger() syscall on userspace-enabled builds (CONFIG_USERSPACE) where an unprivileged thread with I2S device permissions can trigger the dereference, causing a fatal exception in kernel mode.

## Affected products

- Zephyr Zephyr OS v4.4.0 and later (userspace-enabled builds with RISC-V PMP on ESP32-C6 or ESP32-C5)

## Timeline

- 2026-10-11: disclosed

## Related threats

- [Zephyr charger driver kernel privilege escalation via user-mode syscall verification](https://junglewise.ai/threats/cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in)
- [Zephyr kernel thread stack memory leak via k_thread_abort](https://junglewise.ai/threats/cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack)
- [Zephyr USB host stack null pointer dereference in device enumeration](https://junglewise.ai/threats/cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a)
- [Zephyr I2S user-mode syscall verifier unvalidated pointer dereference](https://junglewise.ai/threats/cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers)
- [Zephyr AVRCP Target vendor response buffer leak on disconnection](https://junglewise.ai/threats/cve-2026-85033-the-avrcp-target-role-in-subsys-bluetooth-host-classic-avrcp-c)