Zephyr RTOS EUVD-2026-57069

Zephyr RTOS (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) is an open-source real-time operating system targeting constrained embedded and IoT devices that exposes a POSIX-like socket API through zsock_sendmsg and zsock_recvmsg syscalls. When CONFIG_USERSPACE is enabled, Zephyr enforces a hardware-backed user/kernel privilege boundary; syscall verifier functions (z_vrfy_*) are responsible for safely copying caller-supplied structures into kernel-controlled memory before the privileged implementation executes. The root cause is CWE-367 (Time-of-Check Time-of-Use): the verifier reads the user-space struct net_msghdr field msg_iovlen once via size_mul_overflow() to size a kernel-heap iovec shadow buffer, then reads the same live user-space field a second time as the loop bound during iovec population. Because the msg pointer still references ordinary user memory rather than the kernel snapshot, a cooperating thread in the same address domain can modify msg_iovlen between these two reads - a classic double-fetch - causing the population loop to iterate past the allocated shadow buffer and write attacker-influenced iov_base/iov_len values into adjacent kernel heap objects. The recvmsg verifier carries the identical defect across both its inbound allocation loop and its result write-back loop. The upstream fix (commit 2e0f9cf) eliminates all live re-reads by snapshotting the full net_msghdr header once with k_usermode_from_copy() before any size arithmetic, and copying each iovec entry atomically via a local stack struct so no field can be raced between check and use.