CVE-2026-19595

Что произошло

The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_rtio_cqe_get_mempool_buffer() stores the mempool buffer address and its length through them. The distinction is enforced by every architecture validator — arch_buffer_validate() on RISC-V PMP explicitly accepts the global __rom_region/__rodata_region for reads only, and the ARM MPU validators accept P_RO_U_RO and P_RW_U_RO regions for reads only — so a read-validated pointer is not necessarily writable by the calling thread. An unprivileged user-mode thread that has been granted access to an RTIO context (rtio_access_grant()) can invoke the rtio_cqe_get_mempool_buffer() syscall with buff/buff_len pointing at memory it may read but not write, and with a completion-queue entry whose flags field it fully controls (only RTIO_CQE_FLAG_MEMPOOL_BUFFER in flags[7:0] is required; flags[19:8] and flags[31:20] supply the block index and count). The kernel then performs a pointer-sized and a 4-byte store through those addresses while running in supervisor mode. Reaching the store requires CONFIG_USERSPACE together with CONFIG_RTIO_SYS_MEM_BLOCKS, the configuration behind RTIO_DEFINE_WITH_MEMPOOL; without the latter the implementation returns -ENOTSUP and writes nothing. Two outcomes follow. If the target lies in a memory-domain partition declared K_MEM_PARTITION_P_RW_U_RO (privileged read-write, user read-only), the kernel-mode store succeeds and deposits partly attacker-chosen values into memory the memory domain had marked read-only for that thread, bypassing the partition's write protection. If the target lies in globally readable but unwritable memory such as .text/.rodata in flash, the store faults in kernel mode; the fault is delivered to z_fatal_error() and the default k_sys_fatal_error_handler() halts or reboots the device, giving an unprivileged thread a reliable full denial of service. The read-permission check does bound the damage: the address must still be readable by the calling thread, so kernel-private memory cannot be targeted and no confidential data is disclosed. The fix replaces both checks with K_SYSCALL_MEMORY_WRITE(), so a thread lacking write permission is terminated by K_OOPS before the implementation runs; the cqe argument correctly remains read-validated.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "3.4.0",
  "lessThan": "4.3.2",
  "versionType": "semver"
}

{
  "status": "affected",
  "version": "4.4.0",
  "lessThan": "4.5.0",
  "versionType": "semver"
}

CVSS: оценки и векторы

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Источники и ссылки

{
  "cwes": [
    "cve",
    "nvd"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-03T21:12:26.902038+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-11-04T05:19:11.732477+00:00"
  },
  "scores": [
    "cve",
    "nvd"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-11-04T05:19:11.732477+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-11-04T05:19:11.732477+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-03T21:12:26.902038+00:00"
  },
  "references": [
    "cve",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-11-04T05:19:11.732477+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены04.11.2026, 08:49
2. Данные обновлены04.11.2026, 08:19
3. Данные обновлены04.11.2026, 00:12
4. Данные обновлены03.11.2026, 00:11
5. Данные обновлены02.11.2026, 00:10
6. Данные обновлены31.10.2026, 11:57
7. Данные обновлены29.10.2026, 11:38
8. Появились сведения об исправлении28.10.2026, 21:04

Личная заметка и статус

Другие CVE того же продукта