Quick answers
- Is CVE-2026-87039 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-87039 being exploited in the wild.
- How severe is CVE-2026-87039?
- High severity, with a CVSS score of 7.8, published 4 November 2026.
- Which products and versions are affected?
- Zephyr OS CONFIG_USERSPACE enabled builds.
- Is there a fix for CVE-2026-87039?
- No fixed version is recorded yet. Disable CONFIG_USERSPACE if isolation between user and kernel threads is not required, or restrict access to I2S device objects to trusted threads only. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-87039 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-87039?
- Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Disable CONFIG_USERSPACE if isolation between user and kernel threads is not required, or restrict access to I2S device objects to trusted threads only.
Technical details
The z_vrfy_i2s_configure() syscall verifier skips ownership and type validation of the config.mem_slab pointer when frame_clk_freq is 0 (the unconfigure path), passing an unvalidated user-controlled pointer to kernel code. The i2s_litex driver stores this pointer and later calls k_mem_slab_alloc()/k_mem_slab_free() on it from interrupt context, creating an arbitrary-pointer read/write primitive. The vulnerability only affects builds with CONFIG_USERSPACE enabled and requires the attacker to have access to an I2S device object.
Affected products
- Zephyr Zephyr OS CONFIG_USERSPACE enabled builds
Timeline
- 2026-11-04: disclosed