CVE-2026-9728

TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

Published Aug 24, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window.

On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint).

The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.

Analysis

Technical impact

The mbox_send syscall verifier in Zephyr contains a time‑of‑check/time‑of‑use race. The verifier reads the mbox_msg structure directly from userspace and later forwards the same pointer to the driver. Between the bounds check and the driver read, a competing thread can overwrite msg->data with a kernel address. This allows an unprivileged user to read arbitrary kernel memory or cause a fault for denial of service. The flaw is a classic race condition (CWE‑367) that yields confidentiality compromise and potential service disruption.

Affected Systems

The issue appears in Zephyr projects built with CONFIG_USERSPACE enabled. Any Zephyr installation that supports the mailbox API and permits unprivileged users to call mbox_send is vulnerable. Specific release versions are not listed, but any build containing the unpatched mbox_handlers.c is affected.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires an unprivileged userspace thread that invokes mbox_send and a second thread sharing the same address space to overwrite msg->data with a kernel address. The attack is therefore a local circumstance involving shared memory race; an attacker can read kernel memory or trigger a kernel fault, leading to confidentiality loss or service disruption. The patch that copies the mbox_msg into a kernel stack eliminates the race and closes the vulnerability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

zephyrproject

zephyr

unaffected

Version	Status	Constraints
`3.0.0`	affected	< 4.3.2
`4.4.0`	affected	< 4.4.2

No data.

Vendor Product Versions

Zephyrproject

Zephyr

Version	Status	Scheme	Platform
`[3.0.0,4.4.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Zephyr to a patched release that incorporates commit ab35eaccec5976f05c196f176d0c32885754496f or apply the commit to mbox_handlers.c and rebuild the kernel.
If the patch cannot be applied immediately, disable CONFIG_USERSPACE or restrict the use of mbox_send so that unprivileged userspace threads cannot invoke the syscall.
Ensure that processes or threads that share the same address space are not concurrently executing mailbox operations, for example by enforcing process isolation or limiting concurrency in the application design.

Generated by OpenCVE AI on August 24, 2026 at 19:48 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.110% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/zephyrproject-rtos/zephyr/commit/ab35eaccec5976f05c196f176d0c32885754496f
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-47q2-w832-7w67

History

Aug 25, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 24, 2026 4:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Zephyrproject Zephyrproject zephyr
Vendors & Products		Zephyrproject Zephyrproject zephyr

Aug 24, 2026 2:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window. On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint). The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.
Title		TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
Weaknesses		CWE-367
References		https://github.com/zephyrproject-rtos/zephyr/commit/ab35eaccec5976f05c196f176d0c32885754496f https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-47q2-w832-7w67
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L'}`