The Zephyr RTOS syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() incorrectly checks its out‑parameters buff and buff_len with a read permission instead of a write permission. Because the kernel later writes the mempool buffer address and length to those parameters, an unprivileged user‑mode thread that has an RTIO context can cause the kernel to store data into memory it can read but not write. When the target lies in a read‑only memory domain the store corrupts that domain, and when the target lies in global read‑only flash the store fails in kernel mode, triggering a fatal error that halts or reboots the device. The flaw therefore allows either integrity compromise of privileged partitions or a local denial of service, but it does not disclose confidential data or allow privilege escalation.

The vulnerability affects Zephyr RTOS running on the zephyrproject:zephyr platform in any build that contains the vulnerable rtio_syscalls.c implementation before the patch commit bea93400138362691403b7f81de1e9048681547d. Builds that enable CONFIG_USERSPACE and CONFIG_RTIO_SYS_MEM_BLOCKS and grant an untrusted thread an RTIO context through rtio_access_grant are susceptible; builds that omit these options are not impacted.

The CVSS score of 6.1 indicates medium severity. The EPSS is not available and the issue is not listed in CISA KEV. The attack requires a local unprivileged thread that has been granted RTIO access with RTIO SYS MEM BLOCKS enabled; it does not rely on network exposure or elevated rights. Consequently the risk is moderate, with potential for memory corruption or device failure on affected embedded systems.