---
id: "CVE-2026-19595"
kind: "vulnerability"
aliases: ["CVE-2026-19595"]
title: "Zephyr RTIO: syscall checks read access but writes output pointers"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "rtio", "rtos", "runtime", "zephyr"]
not_affected_if: ["no-rtio-mempool", "no-user-threads", "no-usespace"]
published_at: "2026-10-19T23:17:36+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T04:04:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19595", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Zephyr RTIO: syscall checks read access but writes output pointers

A thread with RTIO access can pass pointers it may only read, and the kernel writes through them in supervisor mode. That can overwrite read-only memory the thread's memory domain protects, or fault the kernel into a fatal error and halt or reboot the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the build enables both `CONFIG_USERSPACE` and `CONFIG_RTIO_SYS_MEM_BLOCKS`, for example with `grep -E 'CONFIG_(USERSPACE|RTIO_SYS_MEM_BLOCKS)=y' prj.conf` or the generated `.config`
- Check the Zephyr version in the tree with `git -C zephyr describe --tags` and compare it against the fixed release named in the advisory (unknown in the sources)

## Fix

- Upgrade Zephyr to a release that includes the fix replacing `K_SYSCALL_MEMORY_READ()` with `K_SYSCALL_MEMORY_WRITE()` for `buff` and `buff_len` in `z_vrfy_rtio_cqe_get_mempool_buffer()` (fixed version unknown in the sources)
- Until patched, avoid granting user-mode threads access to RTIO contexts with `rtio_access_grant()` where the feature is in use

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19595

## From the sources

The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_rtio_cqe_get_mempool_buffer() stores the mempool buffer address and its length through them. The distinction is enforced by every architecture validator — arch_buffer_validate() on RISC-V PMP explicitly accepts the global __rom_region/__rodata_region for reads only, and the ARM MPU validators accept P_RO_U_RO and P_RW_U_RO regions for reads only — so a read-validated pointer is not necessarily writable by the calling thread.

An unprivileged user-mode thread that has been granted access to an RTIO context (rtio_access_grant()) can invoke the rtio_cqe_get_mempool_buffer() syscall with buff/buff_len pointing at memory it may read but not write, and with a completion-queue entry whose flags field it fully controls (only RTIO_CQE_FLAG_MEMPOOL_BUFFER in flags[7:0] is required; flags[19:8] and flags[31:20] supply the block index and count). The kernel then performs a pointer-sized and a 4-byte store through those addresses while running in supervisor mode. Reaching the store requires CONFIG_USERSPACE together with CONFIG_RTIO_SYS_MEM_BLOCKS, the configuration behind RTIO_DEFINE_WITH_MEMPOOL; without the latter the implementation returns -ENOTSUP and writes nothing.

Two outcomes follow. If the target lies in a memory-domain partition declared K_MEM_PARTITION_P_RW_U_RO (privileged read-write, user read-only), the kernel-mode store succeeds and deposits partly attacker-chosen values into memory the memory domain had marked read-only for that thread, bypassing the partition's write protection. If the target lies in globally readable but unwritable memory such as .text/.rodata in flash, the store faults in kernel mode; the fault is delivered to z_fatal_error() and the default k_sys_fatal_error_handler() halts or reboots the device, giving an unprivileged thread a reliable full denial of service.

The read-permission check does bound the damage: the address must still be readable by the calling thread, so kernel-private memory cannot be targeted and no confidential data is disclosed. The fix replaces both checks with K_SYSCALL_MEMORY_WRITE(), so a thread lacking write permission is terminated by K_OOPS before the implementation runs; the cqe argument correctly remains read-validated.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_