Is CVE-2026-87038 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87038 being exploited in the wild.

How severe is CVE-2026-87038?

High severity, with a CVSS score of 7, published 4 November 2026.

Which products and versions are affected?

Zephyr RTOS versions with CONFIG_USERSPACE and I3C driver support prior to fix.

How is CVE-2026-87038 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-87038?

Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87038: Zephyr i3c_transfer TOCTOU privilege escalation

CVE-2026-87038 · Severity: high · CVSS 7 · Published 2026-11-04

Zephyr's I3C (Inter-Integrated Circuit) subsystem contains a time-of-check-time-of-use vulnerability in the user-mode system call handler that allows a malicious unprivileged user thread to execute arbitrary code in the kernel. An attacker with access to an I3C device object can race the kernel's validation of the device descriptor to substitute an attacker-controlled pointer, causing the kernel to dispatch through a fake device API and execute attacker-supplied code with full kernel privileges.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-87038 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87038 being exploited in the wild.
How severe is CVE-2026-87038?: High severity, with a CVSS score of 7, published 4 November 2026.
Which products and versions are affected?: Zephyr RTOS versions with CONFIG_USERSPACE and I3C driver support prior to fix.
Is there a fix for CVE-2026-87038?: Yes: fixed in Zephyr (patched version not specified in advisory). Until then: Disable CONFIG_USERSPACE if I3C drivers are not required, or do not grant unprivileged user threads access to I3C device objects until the patch is applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87038 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-87038?: Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Zephyr (patched version not specified in advisory)

Disable CONFIG_USERSPACE if I3C drivers are not required, or do not grant unprivileged user threads access to I3C device objects until the patch is applied.

Technical details

The z_vrfy_i3c_transfer() verification handler validates a user-supplied i3c_device_desc structure in place and only snapshots the descriptor's bus field once during validation. A second userspace thread can rewrite the bus field after validation but before the kernel uses it in z_impl_i3c_transfer(), exploiting a race window that spans message validation, memory access checks, stack allocation, and memcpy operations. When the substitution succeeds, the kernel dereferences an attacker-controlled pointer as a struct device, loads a function pointer from the attacker's device API table, and calls it with supervisor-mode privileges.

Affected products

Zephyr Zephyr RTOS versions with CONFIG_USERSPACE and I3C driver support prior to fix

Timeline

2026-11-04: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.