{"basis":"claimed","id":"CVE-2026-16511","name":"Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory","vendorProject":"zephyrproject","product":"zephyr","publishedAt":"2026-11-04","cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"exploited":null,"epss":null,"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"vercel":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory","description":"Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them.\n\nz_vrfy_rtio_sqe_cancel() performed no validation at all. It passed the caller's struct rtio_sqe pointer straight to z_impl_rtio_sqe_cancel(), which converts it with CONTAINER_OF to a struct rtio_iodev_sqe, ORs RTIO_SQE_CANCELED (BIT(3)) into its 16-bit flags field in supervisor mode, then loads its next pointer and repeats until that pointer is NULL. The syscall takes no RTIO context argument, so it needs no object grant: any user-mode thread on a CONFIG_USERSPACE build can set that bit in a 16-bit word at an address of its choosing in kernel memory, and the kernel continues the write along whatever pointer chain it finds at the corresponding offset. Setting chosen bits in kernel data structures, such as object permission or thread state fields, can be used to escalate privilege from user mode.\n\nz_vrfy_rtio_sqe_copy_in_get_handles() validated its RTIO context and the input SQE array, but only NULL-checked the handle out-parameter before writing a kernel SQE pointer through it, with no K_SYSCALL_MEMORY_WRITE check. A user thread that holds a granted RTIO context can therefore make the kernel store a pointer value at an arbitrary address.\n\nThe fixes validate the handle out-parameter as writable, bound the cancel handle to real submission-pool storage, and require permission on the RTIO context that owns the matching pool. Without that last check a bounded handle still let any user thread cancel submissions belonging to other contexts, silently aborting their I/O. Systems built without CONFIG_USERSPACE or without CONFIG_RTIO are unaffected.","cwes":["CWE-822","CWE-787","CWE-862"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"vercel","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-04T06:45:13.367Z","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","ssvc":null,"kevAction":null,"kevNotes":null,"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/b1092a0aa7fbe67118ca4b08d5b4e54b34709a6e","name":"Fix commit b1092a0aa7fb","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/95c355c425763fbe5e735b9ef54dacce2c4ce21f","name":"Fix commit 95c355c42576","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/3f244c1709ec0be533ed83d34998e942fc4da399","name":"Fix commit 3f244c1709ec","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3rh4-hpgj-jrww","name":"GHSA-3rh4-hpgj-jrww","tags":[]}],"affected":[{"vendor":"zephyrproject","product":"zephyr","affected":["3.4.0 to before 4.3.2","4.4.0 to before 4.5.0"],"fixed":[]}],"briefing":{"status":{"id":"monitor","label":"Monitor"},"why":"No edge WAF vendor names it in a changelog, so default managed rules may or may not catch it. Exploitation in the wild is not established by CISA KEV.","who":"Teams running zephyrproject zephyr (3.4.0 to before 4.3.2; 4.4.0 to before 4.5.0).","what_to_do":[{"text":"Apply the vendor's fix; the advisory lists the affected and fixed versions.","href":"https://github.com/zephyrproject-rtos/zephyr/commit/b1092a0aa7fbe67118ca4b08d5b4e54b34709a6e","linkText":"Fix commit b1092a0aa7fb"},{"text":"Do not rely on WAF defaults: no edge vendor names this CVE. Restrict access to the vulnerable component or add a custom rule until it is patched.","href":"#edge","linkText":"Edge coverage"},{"text":"Check which WAF sits in front of your site and whether it covers this CVE.","href":"#check","linkText":"Check your domain"}],"evidence":[{"heading":"CVE record","text":"CVSS 3.1 8.8 (high). Weakness: CWE-822, CWE-787, CWE-862.","links":[{"label":"CVE-2026-16511","href":"https://www.cve.org/CVERecord?id=CVE-2026-16511"},{"label":"NVD","href":"https://nvd.nist.gov/vuln/detail/CVE-2026-16511"}]},{"heading":"Vendor advisory","text":"Fixes and mitigations the CVE record links to. Check affected builds against the vendor, including backports.","links":[{"label":"Fix commit b1092a0aa7fb","href":"https://github.com/zephyrproject-rtos/zephyr/commit/b1092a0aa7fbe67118ca4b08d5b4e54b34709a6e"},{"label":"Fix commit 95c355c42576","href":"https://github.com/zephyrproject-rtos/zephyr/commit/95c355c425763fbe5e735b9ef54dacce2c4ce21f"},{"label":"Fix commit 3f244c1709ec","href":"https://github.com/zephyrproject-rtos/zephyr/commit/3f244c1709ec0be533ed83d34998e942fc4da399"}]},{"heading":"Exploit evidence","text":"No public exploit code found in Exploit-DB, Metasploit, nuclei-templates or GitHub. That does not mean none exists.","links":[]},{"heading":"CISA KEV","text":"Not in the KEV catalog (catalog 2026.11.03, checked 2026-11-04). Absence from KEV is not evidence that it cannot be exploited.","links":[{"label":"CISA KEV catalog","href":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}]},{"heading":"WAF vendor statements","text":"No edge vendor changelog names it.","links":[]}],"agent_prompt":"Assess whether the infrastructure available to you is affected by CVE-2026-16511 (Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory). Perform a read-only assessment within your authorized access. Do not send exploit traffic, scan third-party systems, change configuration or restart services.\n\n1. Verify the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-16511 and the vendor advisories (https://github.com/zephyrproject-rtos/zephyr/commit/b1092a0aa7fbe67118ca4b08d5b4e54b34709a6e, https://github.com/zephyrproject-rtos/zephyr/commit/95c355c425763fbe5e735b9ef54dacce2c4ce21f, https://github.com/zephyrproject-rtos/zephyr/commit/3f244c1709ec0be533ed83d34998e942fc4da399). Establish affected and fixed versions, including vendor backports. The record lists: zephyrproject zephyr: affected 3.4.0 to before 4.3.2; 4.4.0 to before 4.5.0. Cite sources and retrieval dates; flag anything you cannot verify.\n2. Inventory deployments of zephyrproject zephyr: asset, environment, owner where known, installed version or build, and how you confirmed it (package metadata, a version endpoint, image tags). An image tag alone does not prove the running version.\n3. Identify which deployments are reachable from the internet or untrusted networks, and through which paths (direct origin, load balancer, CDN or WAF).\n4. Assess compensating controls separately from patch status. Current edge WAF coverage for this CVE: no edge WAF vendor names it. Live data: https://cve.vigilbase.com/api/v1/cves/CVE-2026-16511. Check whether the rule is enabled and in block mode on each path, and whether any path bypasses the WAF. A WAF rule is not a patch.\n5. Check logs on exposed instances for requests matching the public exploit, if your access allows.\n\nReturn a short summary and a table: asset | version/build | assessment (affected, fixed, not applicable, unknown) | exposure | compensating control | evidence | next action. List what you could not assess and the access needed to resolve it. Do not infer absence of compromise from patch status or a lack of alerts.\n\nRemediation guidance: Apply the vendor's fix; the advisory lists the affected and fixed versions. Do not rely on WAF defaults: no edge vendor names this CVE. Restrict access to the vulnerable component or add a custom rule until it is patched.\nMore: https://cve.vigilbase.com/cve/CVE-2026-16511"},"measured":[],"sightings":null,"social":{"total":1,"first_seen":"2026-11-04T06:39:16.000Z","daily":[{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0},{"day":"2026-11-04","posts":1}],"top_posts":[{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/patchthecve.bsky.social/post/3mzhqlp4s4p2p","author":"patchthecve.bsky.social","author_name":null,"avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:5mmktbw2msy3zitzvymgy3yc/bafkreiekwdtemzouzy5tk5fe744sm77vkihsdj3t44wvqrqmiqrtpb3vum","text":"CVE-2026-16511 HIGH (CVSS 8.8)\nTwo RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did no\nFix: https://patchthecve.com/cve/CVE-2026-16511.html","engagement":0,"posted_at":"2026-11-04T06:39:16.000Z"}],"exploit_repositories":[]}}