{"metadata": {"vulnerability": "CVE-2026-19737", "count": 7, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-08-13T13:46:28.028Z", "date_only": false, "value": "2026-08-13T13:46:28.028Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-19737", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-11T17:15:01.878Z", "date_only": false, "value": "2026-10-11T17:15:01.878Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19737", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-11T17:15:01.878Z", "date_only": false, "value": "2026-10-11T17:15:01.878Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-19737", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-11T17:15:01.878Z", "date_only": false, "value": "2026-10-11T17:15:01.878Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / zephyr", "record": "CVE-2026-19737", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-11T17:26:10.596Z", "date_only": false, "value": "2026-10-11T17:26:10.596900Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117423444465789691", "record": "CVE-2026-19737", "field": "creation_timestamp", "uuid": "b0871c4c-18d6-4891-ada3-1efdc3ca58b1", "content": "CVE-2026-19737 NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cfg->rx.data->configured / dev_cfg->tx.data->configured without first checking the stream pointers. The device instantiation macro I2S_ESP32_STREAM_INIT() sets both .conf and .data to NULL for a direction the devicetree does not describe, so on an instance that wires only one direction \u2014 the normal shape for audio output or a worldsemi,ws2812-i2s LED strip \u2014 the other direction dereferences a NULL pointer instead of returning an error.\ni2s_trigger() is a Zephyr syscall, and z_vrfy_i2s_trigger() in drivers/i2s/i2s_handlers.c validates only the device object and the presence of the trigger API pointer; the dir argument is passed to the driver unvalidated. On a build with CONFIG_USERSPACE enabled, a user-mode thread that has been granted the I2S device can issue a single i2s_trigger() call naming the unwired direction and cause a load from address 0 in kernel mode. Among the Espressif parts that carry this driver, userspace is available in-tree only on RISC-V SoCs with CONFIG_RISCV_PMP, and v4.4.0 is the first release where that is buildable: the ESP32-C6 HPCORE selects RISCV_PMP when it is not built for MCUboot. ESP32-C5 in v4.4.x carries the same PMP-region and userspace linker support but does not select RISCV_PMP by default. Espressif Xtensa targets do not support Zephyr userspace, and in a non-userspace build the bad direction can only come from in-kernel application code.\nThe impact is limited to availability: the access is a read at offset 0 of the missing stream structure, so there is no attacker-controlled offset, no write primitive and no information disclosure. With the default fatal-error handler the resulting exception halts the system, giving an unprivileged user-mode thread a system-wide denial of service. The fix adds the same pointer check the I2S_DIR_BOTH branch already performed and returns -ENOSYS for a direction the instance does not implement; the driver's other entry points (i2s_esp32_config_check(), i2s_esp32_config_get(), i2s_esp32_read(), i2s_esp32_write()) already guarded the pointers, and a static audit found no equivalent unguarded path.\nThe driver defect is older than the affected range. The unguarded dereference is present from v4.2.0 (reached through i2s_esp32_trigger_stream(), whose if (stream) guard tests the address of a struct member and is never false) and takes its present i2s_esp32_trigger_check() form in v4.3.0. No in-tree Espressif configuration before v4.4.0 can run a user-mode thread, so in v4.2.x and v4.3.x the direction argument can only come from trusted kernel code. Those releases carry the bug but are not listed as affected; the fix has also been merged to v4.3-branch as hardening.\nhttps://www.cve.org/CVERecord?id=CVE-2026-19737https://github.com/zephyrproject-rtos/zephyr/commit/0d82dbbe72f154de32cc45021a9f59d9a737246bhttps://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5g9q-h8wq-rrf3#zephyrproject #zephyr#CVE_2026_19737#bot", "url": "https://infosec.exchange/users/cve/statuses/117423444465789691"}, {"timestamp": "2026-10-11T18:16:58.930Z", "date_only": false, "value": "2026-10-11T18:16:58.930", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19737", "record": "FKIE_CVE-2026-19737", "field": "published"}, {"timestamp": "2026-10-13T16:53:44.693Z", "date_only": false, "value": "2026-10-13T16:53:44.693", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19737", "record": "FKIE_CVE-2026-19737", "field": "lastModified"}]}