# CVE-2026-87039: Zephyr I2S user-mode syscall verifier unvalidated pointer dereference

Source: https://junglewise.ai/threats/cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-87039 · Severity: high · CVSS 7.8 · Published 2026-11-04

Zephyr is an embedded real-time operating system used in IoT and embedded devices. The I2S audio driver's user-mode syscall verifier fails to validate a memory slab pointer when unconfiguring an audio stream, allowing an unprivileged thread to pass a kernel-mode pointer controlled by the attacker. This enables arbitrary memory reads and writes in kernel context, completely bypassing Zephyr's security isolation.

Technologies: [Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-zephyr-os). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-87039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87039 being exploited in the wild.

**How severe is CVE-2026-87039?** High severity, with a CVSS score of 7.8, published 4 November 2026.

**Which products and versions are affected?** Zephyr OS CONFIG_USERSPACE enabled builds.

**Is there a fix for CVE-2026-87039?** No fixed version is recorded yet. Disable CONFIG_USERSPACE if isolation between user and kernel threads is not required, or restrict access to I2S device objects to trusted threads only. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87039 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-87039?** Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable CONFIG_USERSPACE if isolation between user and kernel threads is not required, or restrict access to I2S device objects to trusted threads only.

## Technical details

The z_vrfy_i2s_configure() syscall verifier skips ownership and type validation of the config.mem_slab pointer when frame_clk_freq is 0 (the unconfigure path), passing an unvalidated user-controlled pointer to kernel code. The i2s_litex driver stores this pointer and later calls k_mem_slab_alloc()/k_mem_slab_free() on it from interrupt context, creating an arbitrary-pointer read/write primitive. The vulnerability only affects builds with CONFIG_USERSPACE enabled and requires the attacker to have access to an I2S device object.

## Affected products

- Zephyr Zephyr OS CONFIG_USERSPACE enabled builds

## Timeline

- 2026-11-04: disclosed

## Related threats

- [Zephyr charger driver kernel privilege escalation via user-mode syscall verification](https://junglewise.ai/threats/cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in)
- [Zephyr kernel thread stack memory leak via k_thread_abort](https://junglewise.ai/threats/cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack)
- [Zephyr USB host stack null pointer dereference in device enumeration](https://junglewise.ai/threats/cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a)
- [Zephyr AVRCP Target vendor response buffer leak on disconnection](https://junglewise.ai/threats/cve-2026-85033-the-avrcp-target-role-in-subsys-bluetooth-host-classic-avrcp-c)
- [Zephyr Bluetooth Classic HFP AG stack crash on RFCOMM connection failure](https://junglewise.ai/threats/cve-2026-82389-in-the-bluetooth-classic-hands-free-profile-audio-gateway-role)