Zephyr RTOS CVE-2026-14367

Physical access to the I3C bus is mandatory - the attack vector is AV:P per the CVSS vector. The attacker must control or emulate an I3C target device capable of generating high-frequency IBIs, hot-join events, or controller-role requests. The target system must be compiled with I3C support enabled (CONFIG_I3C). The race window is narrow, requiring AC:H (high complexity) timing alignment between an incoming IBI interrupt and the workqueue thread's sys_slist_append() operation; under CONFIG_SMP this window widens slightly due to true parallelism. No authentication or user interaction is required on the bus itself (PR:N, UI:N). Exploitation is limited by: physical bus access requirement, need to win a narrow timing race, and the non-deterministic nature of corruption making reliable controlled code execution unlikely.

The CVSS 3.1 vector CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L yields a score of 3.1, accurately reflecting the substantial exploitation barriers: physical access to the I3C bus and winning a narrow timing race. There is no CISA KEV listing and no public exploit code, consistent with the difficulty of achieving reliable memory corruption via a race condition on a constrained embedded bus. The most realistic impact is a crash or hang (denial of service) rather than controlled code execution, as the description itself acknowledges that memory corruption is 'possible but hard to control.' EPSS data is not provided but would be expected to be very low given the physical access requirement and target platform specificity. The Integrity:Low and Availability:Low ratings are accurate - a double-hand-out overwrites a node in flight (integrity), while a garbage-pointer dereference crashes the system (availability). Confidentiality is correctly scored at None. This is a real but low-priority issue except for systems where Zephyr-based I3C hardware is directly accessible by untrusted parties.

An attacker with physical access to the target board attaches a malicious or compromised I3C peripheral device to the bus and programs it to emit rapid, precisely-timed IBIs - targeting the window when the workqueue thread is mid-way through returning a node via sys_slist_append(). If the race is won, the same work node pointer is returned to two concurrent callers; the subsequent memcpy overwrites a node still being processed, most likely crashing the Zephyr kernel. No public exploit code exists; exploitation requires hardware access and iterative timing calibration.