Is CVE-2026-87041 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87041 being exploited in the wild.

How severe is CVE-2026-87041?

High severity, with a CVSS score of 7.8, published 4 November 2026.

Is there a fix for CVE-2026-87041?

Yes: fixed in Zephyr 4.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87041 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-87041?

Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87041: Zephyr RTIO submission-queue verifier memory access bypass

CVE-2026-87041 · Severity: high · CVSS 7.8 · Published 2026-11-04

Zephyr's RTIO (Real-Time I/O) subsystem contains a logic flaw in the submission-queue verifier that inverts memory permission checks, allowing authorized user threads to read or write arbitrary kernel memory through I2C, I3C, and SPI operations. This breaks the kernel's user-mode isolation boundary and enables attackers to leak sensitive kernel data or corrupt kernel state.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-87041 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87041 being exploited in the wild.
How severe is CVE-2026-87041?: High severity, with a CVSS score of 7.8, published 4 November 2026.
Which products and versions are affected?: Zephyr RTOS before 4.3.0.
Is there a fix for CVE-2026-87041?: Yes: fixed in Zephyr 4.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87041 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-87041?: Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Zephyr 4.3.0

Technical details

The rtio_vrfy_sqe() function in subsys/rtio accumulates K_SYSCALL_MEMORY() permission check results using bitwise AND on inverted logic, causing rejection of valid buffers and acceptance of invalid ones. A user-mode thread with RTIO context permissions can submit an SQE (submission queue entry) with a crafted buffer pointer targeting arbitrary kernel memory; downstream I2C, I3C, and SPI RTIO handlers dereference this pointer with supervisor privilege, enabling kernel memory reads (RTIO_OP_TX) or writes (RTIO_OP_RX).

Affected products

Zephyr Zephyr RTOS before 4.3.0

Timeline

2026-11-04: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.