Zephyr RTOS CVE-2026-9728

CONFIG_USERSPACE must be explicitly enabled in the Zephyr build configuration - this is not universally default and must be intentionally configured by the system integrator. The attacker must hold an unprivileged userspace thread on the target system (PR:L per CVSS); fully unauthenticated remote exploitation is not possible. A second thread sharing the caller's address space is required to perform the concurrent overwrite - single-threaded environments or environments where all threads are mutually trusted are not exploitable. The race window is narrow and timing-dependent (AC:H), meaning exploitation requires repeated attempts and precise scheduling; it is not reliably automatable in a single attempt. The vulnerability is specific to the mbox_send() syscall path and manifests only when a mailbox driver (such as the NXP mailbox driver) dereferences msg->data in supervisor context. Exploitation is strictly local - no network vector exists. Confidentiality impact requires knowledge or guessing of a valid mapped kernel address; targeting an invalid/unmapped address instead causes a faulting kernel read (DoS) rather than memory disclosure.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L is well-calibrated to the actual threat: local-only access (AV:L) and high complexity (AC:H) reflect the requirement to win a precise race condition between two threads, substantially lowering practical exploitability compared to network-exploitable or trivially triggered flaws. PR:L confirms an unprivileged-but-present userspace thread is required, not a fully unauthenticated remote attacker. The scope change (S:C) correctly captures the userspace-to-supervisor boundary crossing. EPSS data was not included in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified from available inputs. No CISA KEV listing is present, and no public POC has been identified, meaning active exploitation is not confirmed. The C:H impact is real - a successful race yields arbitrary kernel memory reads - but the AC:H constraint means exploitation is not trivially automatable. SSVC signals (no active exploitation, patch available) suggest a moderate urgency tier appropriate for scheduled patching cycles rather than emergency response for most operators.

An attacker with access to an unprivileged userspace thread on a Zephyr CONFIG_USERSPACE build spawns a second thread sharing the same address space and begins spinning to overwrite msg->data with a target kernel address (e.g., a known kernel data structure) immediately after the mbox_send() syscall is entered. When the race is won between the verifier's K_SYSCALL_MEMORY_READ check and the driver's subsequent memcpy, the driver reads bytes from the attacker-controlled supervisor address in kernel context and forwards them to the mailbox peer endpoint, leaking kernel memory contents. No public POC is identified at time of analysis; the timing window is narrow, requiring repeated attempts to win reliably.