{"id":"CVE-2026-87039","kind":"vulnerability","aliases":["CVE-2026-87039"],"related":[],"title":"Zephyr: I2S unconfigure path lets a user thread reach kernel memory","description":"The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i2s_handlers.c copies the caller's struct i2s_config in from user memory and then, when cfg->frame_clk_freq is 0 (the API's \"unconfigure the stream\" request), jumps straight to z_impl_i2s_configure() without performing the K_SYSCALL_OBJ(config.mem_slab, K_OBJ_MEM_SLAB) ownership/type check or the block_size sanity check. The mem_slab field is a struct k_mem_slab *, so on that path a completely unvalidated, user-chosen pointer reaches driver code that is entitled to trust it as a real kernel object.\n\nAny thread running under CONFIG_USERSPACE that has access to an I2S device object can trigger this with a single i2s_configure() call. Most in-tree drivers special-case frame_clk_freq == 0 and never store the caller's structure, but drivers/i2s/i2s_litex.c does not: i2s_litex_configure() only logs a warning for a mismatched frame clock, then memcpy()s the caller's config into stream->cfg and marks the stream I2S_STATE_READY. A subsequent i2s_trigger() with I2S_TRIGGER_START enables the FIFO interrupt, and the interrupt handlers i2s_litex_isr_rx() / i2s_litex_isr_tx() then call k_mem_slab_alloc() and k_mem_slab_free() on the attacker-supplied pointer in supervisor context.\n\nThe result is an arbitrary-pointer read/write primitive executed by the kernel on behalf of an unprivileged thread — k_mem_slab_alloc() takes a spinlock at slab->lock and reads and writes slab->free_list and the link word inside the returned \"block\" — which defeats the CONFIG_USERSPACE isolation boundary entirely. The same missing validation is a hazard for out-of-tree I2S drivers that retain the configuration on the unconfigure path. Builds without CONFIG_USERSPACE are unaffected, since the verifier is not used.\n\nThe fix zeroes config.mem_slab and config.block_size on the unconfigure path so the driver can never receive an unvalidated pointer, while still allowing a stream to be unconfigured by a caller that does not own a memory slab, as the API documents.","summary":"A user-mode thread calling the I2S configure API with a zero frame clock can pass an unchecked pointer to the kernel, which the LiteX I2S driver later uses as a memory slab. An attacker gets an arbitrary kernel read and write primitive, breaking the user-space isolation boundary.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","i2s","runtime","userspace","zephyr"],"not_affected_if":["default-config","no-i2s-device","no-userspace"],"how_to_check":"- Check whether the build enables `CONFIG_USERSPACE` and includes an I2S driver such as `drivers/i2s/i2s_litex.c`.\n- Look for a custom or out-of-tree I2S driver that keeps the caller's `struct i2s_config` on the unconfigure path.","fix":"- Zephyr fixed versions are not stated in the sources provided; see the patch link for the fix commit.","status":"open","published_at":"2026-11-04T06:17:06+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","triaged_at":"2026-11-04T06:25:56+00:00","updated_at":"2026-11-04T06:25:56+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-04T06:25:56Z","model":"claude-haiku-5-5","output":{"fix":"- Zephyr fixed versions are not stated in the sources provided; see the patch link for the fix commit.","reach":"local","title":"Zephyr: I2S unconfigure path lets a user thread reach kernel memory","impact":"high","summary":"A user-mode thread calling the I2S configure API with a zero frame clock can pass an unchecked pointer to the kernel, which the LiteX I2S driver later uses as a memory slab. An attacker gets an arbitrary kernel read and write primitive, breaking the user-space isolation boundary.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","i2s","userspace"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Unprivileged thread gains kernel-level arbitrary memory read and write","analyst_note":"Confirm the fixed Zephyr version and the patched release range from the linked patch and vendor advisory; the sources given do not list versions.","how_to_check":"- Check whether the build enables `CONFIG_USERSPACE` and includes an I2S driver such as `drivers/i2s/i2s_litex.c`.\n- Look for a custom or out-of-tree I2S driver that keeps the caller's `struct i2s_config` on the unconfigure path.","plain_action":"","needs_analyst":true,"not_affected_if":["no-userspace","no-i2s-device","default-config"],"who_is_affected":"Systems built on Zephyr with CONFIG_USERSPACE enabled that have an I2S device, especially those using the LiteX I2S driver or an out-of-tree I2S driver that retains configuration on unconfigure. Builds without CONFIG_USERSPACE are not affected because the verifier is not used.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000809,"input_tokens":4856,"output_tokens":647,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-87039':14A,17A '0':105C,209C 'access':183C 'alloc':279C,316C 'allow':403C 'api':32B,107C,421C 'arbitrari':61B,299C 'arbitrary-point':298C 'attack':58B,288C 'attacker-suppli':287C 'behalf':308C 'block':136C,337C 'boundari':73B,344C 'break':67B 'build':368C 'call':28B,197C,275C 'caller':88C,214C,237C,411C 'case':205C 'cfg':100C,242C 'check':133C,139C 'chosen':159C 'clk':102C,207C 'clock':37B,232C 'code':163C 'complet':155C 'config':92C,179C,239C,341C,370C 'config.block':386C 'config.mem':126C,383C 'configur':31B,83C,119C,196C,223C,363C 'context':293C 'copi':86C 'cve':12A,15A 'defeat':339C 'devic':187C 'document':422C 'driver':50B,162C,202C,359C,394C 'drivers/i2s/i2s_handlers.c':85C 'drivers/i2s/i2s_litex.c':218C 'embed':18B 'enabl':258C 'entir':345C 'entitl':166C 'execut':303C 'field':143C 'fifo':260C 'fix':381C 'frame':36B,101C,206C,231C 'free':284C,328C 'freq':103C,208C 'get':59B 'handler':265C 'hazard':352C 'i2s':2A,19B,30B,49B,82C,91C,118C,186C,195C,221C,247C,252C,255C,266C,270C,358C 'impl':117C 'in-tre':199C 'insid':334C 'interrupt':261C,264C 'isol':72B,343C 'isr':268C,272C 'jump':113C 'k':123C,128C,147C,276C,281C,313C 'kernel':10A,45B,62B,173C,306C 'later':51B 'let':5A 'link':332C 'list':329C 'litex':48B,222C,267C,271C 'lock':322C 'log':225C 'mark':244C 'mem':130C,141C,148C,277C,282C,314C 'memcpi':234C 'memori':11A,55B,96C,417C 'mismatch':230C 'miss':348C 'mode':26B,77C 'never':211C,396C 'obj':125C,129C 'object':174C,188C 'out-of-tre':354C 'ownership/type':132C 'pass':39B 'path':4A,153C,367C,391C 'perform':121C 'pointer':42B,160C,290C,300C,400C 'primit':66B,302C 'reach':9A,161C 'read':63B,324C 'read/write':301C 'readi':249C 'real':172C 'receiv':397C 'request':112C 'result':295C 'retain':361C 'return':336C 'run':177C 'runtim':20B 'rx':269C 'saniti':138C 'sinc':374C 'singl':194C 'size':137C,387C 'slab':56B,127C,131C,142C,149C,278C,283C,315C,321C,327C,384C,418C 'space':71B 'special':204C 'special-cas':203C 'spinlock':319C 'start':257C 'state':248C 'still':402C 'store':212C 'straight':114C 'stream':111C,241C,246C,405C 'struct':90C,146C 'structur':216C 'subsequ':251C 'supervisor':292C 'suppli':289C 'syscal':78C,124C 'take':317C 'thread':8A,27B,176C,312C 'tree':201C,357C 'trigger':190C,253C,256C 'trust':168C 'tx':273C 'unaffect':373C 'uncheck':41B 'unconfigur':3A,109C,366C,390C,408C 'unprivileg':311C 'unvalid':156C,399C 'use':52B,379C 'user':7A,25B,70B,76C,95C,158C 'user-chosen':157C 'user-mod':24B,75C 'user-spac':69B 'userspac':21B,180C,342C,371C 'valid':349C 'verifi':79C,376C 'vrfi':81C 'warn':227C 'without':120C,369C 'word':333C 'write':65B,326C 'z':80C,116C 'zephyr':1A,22B 'zero':35B,382C","nicknames":[],"mitigations":[],"who_affected":"Systems built on Zephyr with CONFIG_USERSPACE enabled that have an I2S device, especially those using the LiteX I2S driver or an out-of-tree I2S driver that retains configuration on unconfigure. Builds without CONFIG_USERSPACE are not affected because the verifier is not used.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","i2s","runtime","userspace","zephyr"],"campaign_type":null,"first_public_at":"2026-11-04T05:23:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87039","severity":null,"published_at":"2026-11-04T06:17:06+00:00","modified_at":"2026-11-04T06:17:06+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","fetched_at":"2026-11-04T06:25:20+00:00","note":null}],"documents":[{"id":64656,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/e9898c4d22f69575d9b5f297b3df130ceaff1b8f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":64657,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-g43m-x6vj-5cg2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T05:23:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}