CVE-2026-16511: Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
Two RTIO syscall verifiers, in subsys/rtio/rtiosyscalls.c (subsys/rtio/rtiohandlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them.
zvrfyrtiosqecancel() performed no validation at all. It passed the caller's struct rtiosqe pointer straight to zimplrtiosqecancel(), which converts it with CONTAINEROF to a struct rtioiodevsqe, ORs RTIOSQECANCELED (BIT(3)) into its 16-bit flags field in supervisor mode, then loads its next pointer and repeats until that pointer is NULL. The syscall takes no RTIO context argument, so it needs no object grant: any user-mode thread on a CONFIGUSERSPACE build can set that bit in a 16-bit word at an address of its choosing in kernel memory, and the kernel continues the write along whatever pointer chain it finds at the corresponding offset. Setting chosen bits in kernel data structures, such as object permission or thread state fields, can be used to escalate privilege from user mode.
zvrfyrtiosqecopyingethandles() validated its RTIO context and the input SQE array, but only NULL-checked the handle out-parameter before writing a kernel SQE pointer through it, with no KSYSCALLMEMORYWRITE check. A user thread that holds a granted RTIO context can therefore make the kernel store a pointer value at an arbitrary address.
The fixes validate the handle out-parameter as writable, bound the cancel handle to real submission-pool storage, and require permission on the RTIO context that owns the matching pool. Without that last check a bounded handle still let any user thread cancel submissions belonging to other contexts, silently aborting their I/O. Systems built without CONFIGUSERSPACE or without CONFIGRTIO are unaffected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Build systems without CONFIG_USERSPACE or without CONFIG_RTIO to avoid the affected RTIO syscall behavior.
Zephyr RTIO CONFIG_USERSPACE or CONFIG_RTIO = disabled
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue affects CONFIG_USERSPACE builds where user-mode threads can invoke the affected RTIO syscalls. The cancel syscall requires no RTIO context argument or object grant, so any user-mode thread can reach it.
What does an attacker need to exploit the cancel path?
An attacker needs local code execution as a user-mode thread. They can provide a crafted RTIO SQE pointer that causes the kernel to set the RTIO_SQE_CANCELED bit in a chosen 16-bit kernel-memory location and follow a pointer chain from the corresponding structure offset.
What is the practical impact of successful exploitation?
The attacker can modify selected bits in kernel data structures while executing from user mode. The provided analysis identifies object-permission and thread-state fields as examples that may permit privilege escalation.
Are both affected syscalls exposed in the same way?
No. The cancel verifier performs no pointer validation and needs no RTIO object grant, while the copy-in-get-handles verifier validates its RTIO context and input SQE array but only NULL-checks the handle output pointer before writing a kernel SQE pointer through it.