Description
The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window.

On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint).

The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.
Published: 2026-08-24
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel memory disclosure
Action: Apply patch
AI Analysis

Impact

The mbox_send syscall verifier in Zephyr contains a time‑of‑check/time‑of‑use race. The verifier reads the mbox_msg structure directly from userspace and later forwards the same pointer to the driver. Between the bounds check and the driver read, a competing thread can overwrite msg->data with a kernel address. This allows an unprivileged user to read arbitrary kernel memory or cause a fault for denial of service. The flaw is a classic race condition (CWE‑367) that yields confidentiality compromise and potential service disruption.

Affected Systems

The issue appears in Zephyr projects built with CONFIG_USERSPACE enabled. Any Zephyr installation that supports the mailbox API and permits unprivileged users to call mbox_send is vulnerable. Specific release versions are not listed, but any build containing the unpatched mbox_handlers.c is affected.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires an unprivileged userspace thread that invokes mbox_send and a second thread sharing the same address space to overwrite msg->data with a kernel address. The attack is therefore a local circumstance involving shared memory race; an attacker can read kernel memory or trigger a kernel fault, leading to confidentiality loss or service disruption. The patch that copies the mbox_msg into a kernel stack eliminates the race and closes the vulnerability.

Generated by OpenCVE AI on August 24, 2026 at 19:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a patched release that incorporates commit ab35eaccec5976f05c196f176d0c32885754496f or apply the commit to mbox_handlers.c and rebuild the kernel.
  • If the patch cannot be applied immediately, disable CONFIG_USERSPACE or restrict the use of mbox_send so that unprivileged userspace threads cannot invoke the syscall.
  • Ensure that processes or threads that share the same address space are not concurrently executing mailbox operations, for example by enforcing process isolation or limiting concurrency in the application design.

Generated by OpenCVE AI on August 24, 2026 at 19:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 24 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window. On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint). The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.
Title TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
Weaknesses CWE-367
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-25T19:06:35.431Z

Reserved: 2026-05-27T17:11:30.502Z

Link: CVE-2026-9728

cve-icon Vulnrichment

Updated: 2026-08-25T19:06:32.255Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-24T15:16:49.010

Modified: 2026-08-26T16:59:23.267

Link: CVE-2026-9728

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T20:00:04Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition