CVE-2026-16513

Published 28 September 2026 · tracked since 29 September 2026

Description

The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop iteration it executed *handle = sqe, storing the kern

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-102264 LOW 3.5
• CVE-2026-102263 MEDIUM 4.7
• CVE-2026-102414 LOW 3.7
• CVE-2026-102422 HIGH 8.1
• CVE-2026-102247 MEDIUM 6.8
• CVE-2026-96326 HIGH 7.2
• CVE-2026-101858 MEDIUM 4.7
• CVE-2026-101859 MEDIUM 5.4
• CVE-2026-101860 HIGH 8.8
• CVE-2026-101280 HIGH 7.3

→ Open the live CVE board · all tools