CVE-2026-9728

What it is

The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window. On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint). The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account. High risk of data exposure.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-24 15:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-11-04 05:19 UTC Last updatedMost recent change to the record

Details

Published

2026-08-24 15:16 UTC

Last modified

2026-11-04 05:19 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-367

Record status

Awaiting Analysis

Attack profile CVSS 3.1 · 6.4

Attack vector

Local

Complexity

High

Privileges needed

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low