{"schema":"threatline.record/2","record":{"id":"CVE-2026-19185","aliases":["GHSA-pcrr-29j7-8w57"],"summary":"Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode","details":"The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the per-target data buffers those array elements point at. Each struct i3c_ccc_target_payload carries its own data pointer and data_len, and neither was passed through K_SYSCALL_MEMORY() before the payload was handed to z_impl_i3c_do_ccc() and on to the controller driver. The verifier also operated on the caller's live structure rather than a snapshot, so validated fields could be changed by a second user thread between the check and the driver's use — unlike the sibling z_vrfy_i3c_transfer(), which has always copied its message array first.\n\nThe defect is only present in CONFIG_USERSPACE builds, where drivers/i3c/i3c_handlers.c is compiled. An unprivileged user-mode thread that has been granted access to the I3C controller device object — the ordinary way an application lets a user thread talk to I3C peripherals — can issue a direct CCC whose target payload data pointer names an arbitrary kernel address. Controller drivers dereference that pointer directly (for example drivers/i3c/i3c_mcux.c, drivers/i3c/i3c_cdns.c, drivers/i3c/i3c_stm32.c, drivers/i3c/i3c_npcx.c), using rnw to decide direction.\n\nA read CCC therefore causes the kernel-mode driver to write bus-received bytes into an attacker-chosen kernel address for an attacker-chosen length, and a write CCC transmits kernel memory out onto the I3C bus. The result is an out-of-bounds kernel write plus a kernel memory disclosure, i.e. escalation from a user-mode thread to supervisor privilege, defeating the isolation CONFIG_USERSPACE is meant to provide.\n\nThe fix introduces copy_ccc_and_do(), which snapshots the payload, copies the target array into kernel memory with k_usermode_alloc_from_copy() (bounding num_targets to fewer than 32), validates each per-target buffer with K_SYSCALL_MEMORY() according to rnw, and copies the driver-written num_xfer and err fields back to the caller.","categories":["Unclassified"],"product":"zephyr","vendor":"zephyrproject","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19185","source_modified_at":"2026-10-05T14:06:55.566Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"zephyr","vendor":"zephyrproject","versions":[{"version":"3.2.0","status":"affected","lessThan":"4.5.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19185","source_modified_at":"2026-10-05T14:06:55.566Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"zephyr","ecosystem":null},"version":"4.5.0","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00114,"percentile":0.01405,"score_date":"2026-10-23"},"published_at":"2026-10-05T08:06:29.874Z","modified_at":"2026-10-05T14:06:55.566Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-19185","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-05T14:06:55.566Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19185","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/commit/35562f22f40c6d2f31969a31f0a4902e5b067f27","tags":["patch"]},{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pcrr-29j7-8w57"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-05T14:06:01.294641Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T14:06:55.566Z","content_hash":"33286fc1b66c8b911b137d6e41b280bbf0f4b949558a6fe7d8c2b75b971f1d54"}}