Time-of-Check-Time-of-Use in I3C System Call Handler

The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c, validated the caller-supplied struct i3c_device_desc in place instead of snapshotting it. It confirmed only that the descriptor was readable by the calling thread (K_SYSCALL_MEMORY_READ()), read target->bus once to check it with K_SYSCALL_OBJ(), and then passed the caller's live pointer down. The implementation z_impl_i3c_transfer() re-reads target->bus from that user memory and dispatches through it as DEVICE_API_GET(i3c, target->bus)->i3c_xfers(...), so the bus that was validated is not necessarily the bus that is used. DEVICE_API_GET() performs no runtime type check outside CONFIG_DEVICE_API_ASSERT builds. On a build with CONFIG_USERSPACE and an I3C controller driver, a user thread that has been granted an I3C device object can exploit this with a second thread in the same memory domain: one thread calls i3c_transfer() while the other rewrites the bus field of

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-87038 represents a critical time-of-check-time-of-use (TOCTOU) vulnerability in the Zephyr RTOS i3c_transfer() system call handler. The vulnerability exists because the user-mode verification function z_vrfy_i3c_transfer() validates a caller-supplied i3c_device_desc structure only once—checking that target->bus is readable and valid—but then passes a live pointer to the unprotected user memory down to the kernel implementation z_impl_i3c_transfer(). An attacker can modify the structure between the verification check and the actual use, potentially gaining unauthorized access to I3C bus operations or corrupting kernel state. This affects any embedded or IoT system running Zephyr RTOS with I3C device drivers, making it particularly dangerous in resource-constrained environments where kernel integrity is critical.

Casky's 224 mapped skills, powered by Claude AI's extended reasoning, detect the adversarial patterns behind this vulnerability by analyzing Privilege Escalation techniques (TA0004) across multiple attack vectors. Practitioners using Casky would identify findings related to CWE-367 (TOCTOU race conditions) through skill coverage of techniques like Exploitation of Vulnerability (T1190) and Abuse of Functionality (T1648), which flag unsafe kernel-userspace boundary transitions. The platform's security skills would surface indicators such as: repeated memory reads from untrusted user pointers without proper snapshots, discrepancies between verification and use of security-critical objects, and patterns where kernel code re-reads user-supplied memory after initial validation. Practitioners examining their I3C driver implementations would receive actionable alerts on defensive coding gaps—specifically the absence of structure snapshots via copy_from_user()-style mechanisms—enabling rapid remediation before exploitation occurs in production systems.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-87038.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-87038

Casky has 224 skills that investigate the attack patterns behind CVE-2026-87038. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn