Zephyr RTOS EUVD-2026-92286

Exploitable ONLY in builds compiled with CONFIG_USERSPACE (which is when drivers/i3c/i3c_handlers.c is built) that also include an I3C controller driver (e.g. i3c_mcux, i3c_cdns, i3c_stm32, i3c_npcx). The attacker must be a local unprivileged user-mode thread that has been granted access to the I3C controller device object - the ordinary mechanism by which an application lets a user thread talk to I3C peripherals; there is no remote or network path. The specific trigger is a direct CCC request whose per-target struct i3c_ccc_target_payload data pointer and data_len were never passed through K_SYSCALL_MEMORY(); rnw selects whether this becomes a kernel write (read CCC) or a disclosure (write CCC). Limiting factors: requires local execution, a pre-existing device-access grant, and a build that enables userspace isolation and I3C - devices without CONFIG_USERSPACE are entirely unaffected.

All signals point to a genuine but condition-gated local privilege-escalation issue rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: this is local-only (an attacker must already run a user-mode thread on the device), low-complexity, and requires only low privilege (an unprivileged thread that has been granted access to the I3C controller device object). Impact is correctly rated high across confidentiality, integrity and availability because the flaw yields an arbitrary-length out-of-bounds kernel write and kernel memory disclosure - a clean break of the user/supervisor isolation CONFIG_USERSPACE is designed to enforce. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so there is no evidence of active exploitation; per the input this is 'no public exploit identified at time of analysis.' The realistic priority is therefore moderate-to-high for the narrow population actually running affected configurations and low for everyone else: exploitation is impossible unless the build enables CONFIG_USERSPACE, compiles the I3C subsystem, and deliberately grants a user thread access to the controller device. The absence of a network vector and the local-plus-granted-access precondition sharply limit real-world exposure despite the high base score. No signals conflict; the main caveat is that the only exploitation evidence is the vendor's own code fix and advisory, with no independent exploitation telemetry.

On a Zephyr device built with CONFIG_USERSPACE, an unprivileged application thread that has legitimately been granted access to the I3C controller device issues a direct CCC syscall whose per-target payload data pointer names an arbitrary kernel address. Because the verifier never ran K_SYSCALL_MEMORY() on the per-target buffer, a read CCC makes the kernel driver write bus bytes into attacker-chosen kernel memory while a write CCC leaks kernel memory onto the bus, giving the thread supervisor-level control. No public exploit is identified at time of analysis; exploitation requires local code execution and prior device-access grant.