{"id":"CVE-2026-16511","kind":"vulnerability","aliases":["CVE-2026-16511"],"related":[],"title":"Zephyr RTIO: user threads can write arbitrary kernel memory via syscalls","description":"Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them.\n\nz_vrfy_rtio_sqe_cancel() performed no validation at all. It passed the caller's struct rtio_sqe pointer straight to z_impl_rtio_sqe_cancel(), which converts it with CONTAINER_OF to a struct rtio_iodev_sqe, ORs RTIO_SQE_CANCELED (BIT(3)) into its 16-bit flags field in supervisor mode, then loads its next pointer and repeats until that pointer is NULL. The syscall takes no RTIO context argument, so it needs no object grant: any user-mode thread on a CONFIG_USERSPACE build can set that bit in a 16-bit word at an address of its choosing in kernel memory, and the kernel continues the write along whatever pointer chain it finds at the corresponding offset. Setting chosen bits in kernel data structures, such as object permission or thread state fields, can be used to escalate privilege from user mode.\n\nz_vrfy_rtio_sqe_copy_in_get_handles() validated its RTIO context and the input SQE array, but only NULL-checked the handle out-parameter before writing a kernel SQE pointer through it, with no K_SYSCALL_MEMORY_WRITE check. A user thread that holds a granted RTIO context can therefore make the kernel store a pointer value at an arbitrary address.\n\nThe fixes validate the handle out-parameter as writable, bound the cancel handle to real submission-pool storage, and require permission on the RTIO context that owns the matching pool. Without that last check a bounded handle still let any user thread cancel submissions belonging to other contexts, silently aborting their I/O. Systems built without CONFIG_USERSPACE or without CONFIG_RTIO are unaffected.","summary":"Two RTIO syscall verifiers in Zephyr fail to validate user-supplied pointers, so a user-mode thread can set bits and store pointer values at addresses it chooses in kernel memory. An attacker can use this to change kernel object permissions or thread state and escalate privilege, and the second flaw also lets a thread with a granted RTIO context cancel other contexts' I/O.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","rtos","runtime","userspace","zephyr"],"not_affected_if":["kernel-only-builds","no-rtio","no-userspace"],"how_to_check":"- Check whether the build enables `CONFIG_USERSPACE` and `CONFIG_RTIO`; systems built without either are unaffected.\n- Check the Zephyr version: releases before `v4.3.0` contain the flawed `subsys/rtio/rtio_handlers.c` code.","fix":"- Zephyr: move to a release at or after `v4.3.0` (the sources reference the fix against v4.3.0; the exact patched point releases are not stated in the sources).","status":"open","published_at":"2026-11-04T06:17:04+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","triaged_at":"2026-11-04T06:25:53+00:00","updated_at":"2026-11-04T06:25:53+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-04T06:25:53Z","model":"claude-haiku-5-5","output":{"fix":"- Zephyr: move to a release at or after `v4.3.0` (the sources reference the fix against v4.3.0; the exact patched point releases are not stated in the sources).","reach":"local","title":"Zephyr RTIO: user threads can write arbitrary kernel memory via syscalls","impact":"high","summary":"Two RTIO syscall verifiers in Zephyr fail to validate user-supplied pointers, so a user-mode thread can set bits and store pointer values at addresses it chooses in kernel memory. An attacker can use this to change kernel object permissions or thread state and escalate privilege, and the second flaw also lets a thread with a granted RTIO context cancel other contexts' I/O.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","rtos","userspace"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"user thread writes kernel memory, enabling privilege escalation","analyst_note":"","how_to_check":"- Check whether the build enables `CONFIG_USERSPACE` and `CONFIG_RTIO`; systems built without either are unaffected.\n- Check the Zephyr version: releases before `v4.3.0` contain the flawed `subsys/rtio/rtio_handlers.c` code.","plain_action":"","needs_analyst":false,"not_affected_if":["no-userspace","no-rtio","kernel-only-builds"],"who_is_affected":"Only embedded systems built with Zephyr's userspace support and the RTIO subsystem are exposed, since the flaw needs user-mode threads making RTIO syscalls. The second bug needs a user thread that holds a granted RTIO context. Systems built without CONFIG_USERSPACE or without CONFIG_RTIO can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000808,"input_tokens":4765,"output_tokens":662,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-16511':14A,17A '-2026':13A,16A '16':157C,205C '3':154C 'abort':372C 'address':50B,210C,320C 'along':223C 'also':76B 'arbitrari':7A,319C 'argument':182C 'array':273C 'attack':57B 'belong':367C 'bit':44B,153C,158C,202C,206C,235C 'bound':331C,358C 'build':198C 'built':376C 'caller':124C 'cancel':85B,115C,136C,152C,333C,365C 'chain':226C 'chang':62B 'check':278C,298C,356C 'choos':52B,213C 'chosen':234C 'config':196C,378C,382C 'contain':141C 'context':84B,87B,181C,268C,307C,347C,370C 'continu':220C 'convert':138C 'copi':261C 'correspond':231C 'cve':12A,15A 'data':238C 'embed':18B 'escal':70B,252C 'fail':29B 'field':160C,247C 'find':228C 'fix':322C 'flag':159C 'flaw':75B 'get':263C 'grant':82B,188C,305C 'handl':264C,280C,325C,334C,359C 'hold':303C 'i/o':88B,374C 'impl':133C 'input':271C 'iodev':147C 'k':294C 'kernel':8A,54B,63B,107C,215C,219C,237C,287C,312C 'last':355C 'let':77B,361C 'load':165C 'make':310C 'match':351C 'memori':9A,55B,216C,296C 'mode':40B,163C,192C,256C 'need':185C 'next':167C 'null':175C,277C 'null-check':276C 'object':64B,187C,242C 'offset':232C 'or':149C 'out-paramet':281C,326C 'own':349C 'paramet':283C,328C 'pass':122C 'perform':116C 'permiss':65B,243C,343C 'pointer':35B,47B,104C,129C,168C,173C,225C,289C,315C 'pool':339C,352C 'privileg':71B,253C 'real':336C 'repeat':170C 'requir':342C 'rtio':2A,24B,83B,90C,113C,127C,134C,146C,150C,180C,259C,267C,306C,346C,383C 'rtos':19B 'runtim':20B 'second':74B 'set':43B,200C,233C 'silent':371C 'sqe':114C,128C,135C,148C,151C,260C,272C,288C 'state':68B,246C 'still':360C 'storag':340C 'store':46B,313C 'straight':130C 'struct':126C,145C 'structur':239C 'submiss':338C,366C 'submission-pool':337C 'subsys/rtio/rtio_handlers.c':95C 'subsys/rtio/rtio_syscalls.c':94C 'supervisor':162C 'suppli':34B,103C 'syscal':11A,25B,91C,177C,295C 'system':375C 'take':178C 'therefor':309C 'thread':4A,41B,67B,79B,193C,245C,301C,364C 'two':23B,89C 'unaffect':385C 'use':59B,250C 'user':3A,33B,39B,102C,191C,255C,300C,363C 'user-mod':38B,190C 'user-suppli':32B,101C 'userspac':21B,197C,379C 'v4.3.0':97C 'valid':31B,100C,118C,265C,323C 'valu':48B,316C 'verifi':26B,92C 'via':10A 'vrfi':112C,258C 'whatev':224C 'without':353C,377C,381C 'word':207C 'writabl':330C 'write':6A,222C,285C,297C 'wrote':108C 'z':111C,132C,257C 'zephyr':1A,22B,28B","nicknames":[],"mitigations":[],"who_affected":"Only embedded systems built with Zephyr's userspace support and the RTIO subsystem are exposed, since the flaw needs user-mode threads making RTIO syscalls. The second bug needs a user thread that holds a granted RTIO context. Systems built without CONFIG_USERSPACE or without CONFIG_RTIO can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","rtos","runtime","userspace","zephyr"],"campaign_type":null,"first_public_at":"2026-11-03T22:29:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16511","severity":null,"published_at":"2026-11-04T06:17:04+00:00","modified_at":"2026-11-04T06:17:04+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","fetched_at":"2026-11-04T06:25:20+00:00","note":null}],"documents":[{"id":64647,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/3f244c1709ec0be533ed83d34998e942fc4da399","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":64648,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/95c355c425763fbe5e735b9ef54dacce2c4ce21f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":64649,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/b1092a0aa7fbe67118ca4b08d5b4e54b34709a6e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":64650,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3rh4-hpgj-jrww","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T22:29:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}