CVE-2026-87038 | Zephyr Project up to 4.3.1/4.4.x I3C i3c_handlers.c z_vrfy_i3c_transfer bus toctou

November 4, 2026 Yanac

A vulnerability was found in Zephyr Project Zephyr up to 4.3.1/4.4.x and classified as very critical. This vulnerability affects the function z_vrfy_i3c_transfer of the file drivers/i3c/i3c_handlers.c of the component I3C. Such manipulation of the argument bus leads to time-of-check time-of-use.

This vulnerability is traded as CVE-2026-87038. An attack has to be approached locally. There is no exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More