{"id":"CVE-2026-82961","aliases":[],"cve":{"records":[{"id":"CVE-2026-82961","source":"zephyr","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-31T13:10:32.703Z","published":"2026-10-28T16:58:58.927Z","modified":"2026-10-28T16:58:58.927Z"}],"publishers":[{"name":"zephyr","role":"CNA","organizationId":"e2e69745-5e70-4e92-8431-deb5529a81ad","modified":"2026-10-28T16:58:58.927Z"}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/020e83e06b35e98a4a3c2354f67e5eee3f163363","tags":["patch"],"source":"zephyr"},{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/d145faab7e3a8cea62a8fd7ed5f30ef73e762f59","tags":["patch"],"source":"zephyr"},{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/c9641fa5bfec44892e0cf2d84f78c7c60fca8ad6","tags":["patch"],"source":"zephyr"},{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/d28a05d5de4420f27ba3de7b9e4442fa056d51de","tags":["patch"],"source":"zephyr"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4f2x-8qw8-jjgf","tags":[],"source":"zephyr"}],"weaknesses":[{"id":"CWE-787","description":"bounds","source":"zephyr"}],"applicability":[],"prioritization":[]},"title":"Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode","titleSource":"zephyr","descriptionSource":"zephyr","description":"The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config() and z_vrfy_gpio_pin_interrupt_configure() verified only the device object (K_SYSCALL_DRIVER_GPIO() / K_SYSCALL_OBJ()) and then passed the caller-supplied gpio_pin_t straight through to z_impl_gpio_pin_*() and on to the driver. The only pin check in include/zephyr/drivers/gpio.h was __ASSERT(gpio_port_pin_is_supported(cfg->port_pin_mask, pin), ...), which compiles to nothing unless CONFIG_ASSERT is enabled, so in a production build no check existed at all.\n\nGPIO drivers use pin as a shift count and as an array index on the documented assumption that it is a pin the controller supports. On STM32, for example, gpio_stm32_pin_interrupt_configure() turns pin into an EXTI line and stm32_gpio_intc_set_irq_callback() writes data->cb[line_num].cb and data->cb[line_num].data into a NUM_EXTI_LINES-entry array (default 16) in drivers/interrupt_controller/intc_gpio_stm32.c, guarded only by a compiled-out __ASSERT_NO_MSG(); the same function then reads exti_irq_table[line_num] and calls irq_enable() on the result. Other controllers index fixed-size per-pin configuration tables the same way — drivers/gpio/gpio_ite_it8xxx2_v2.c reads an MMIO base pointer out of wuc_base[8] with the caller's pin and performs a read-modify-write through it.\n\nThe issue is reachable only in builds with CONFIG_USERSPACE=y (the file is compiled under that symbol), by a user-mode thread that has been granted access to a GPIO device object. Such a grant is intended to authorize control of that port's pins; the missing validation instead lets the thread drive a supervisor-mode out-of-bounds write of a function pointer and an associated void * past a kernel .bss array, and out-of-bounds reads that feed irq_enable() and MMIO accesses — an escape from the user-mode sandbox that can lead to kernel memory corruption, arbitrary code execution, or a crash.\n\nThe fix validates pin against the controller's gpio_driver_config.port_pin_mask with gpio_port_pin_is_supported() in every pin-taking z_vrfy_ handler and returns -EINVAL otherwise, complemented by an unconditional pin >= GPIO_MAX_PINS_PER_PORT range check added to the shared z_impl_gpio_pin_*() inlines.","score":7.8,"severity":"high","published":"2026-10-28T16:58:58.927Z","modified":"2026-10-28T16:58:58.927Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"zephyrproject","name":"zephyr","platforms":[],"versions":[{"version":"2.2.0","status":"affected","lessThanOrEqual":"4.4.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"zephyr","url":"https://www.cve.org/CVERecord?id=CVE-2026-82961"}],"remediation":[],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/020e83e06b35e98a4a3c2354f67e5eee3f163363","https://github.com/zephyrproject-rtos/zephyr/commit/d145faab7e3a8cea62a8fd7ed5f30ef73e762f59","https://github.com/zephyrproject-rtos/zephyr/commit/c9641fa5bfec44892e0cf2d84f78c7c60fca8ad6","https://github.com/zephyrproject-rtos/zephyr/commit/d28a05d5de4420f27ba3de7b9e4442fa056d51de","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4f2x-8qw8-jjgf"],"sources":[{"name":"CVE","id":"CVE-2026-82961","modified":"2026-10-28T16:58:58.927Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-82961"}],"assessments":[{"source":"zephyr","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-10-29T14:44:38.370Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:05:32.453Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T17:20:31.637Z","attemptedAt":"2026-10-28T17:20:31.637Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T17:20:31.637Z","attemptedAt":"2026-10-28T17:20:31.637Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-28T17:20:31.637Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T17:20:31.637Z","attemptedAt":"2026-10-28T17:20:31.637Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-82961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82961","modified":"2026-10-28T17:18:43.803","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T17:20:31.637Z"}],"aiSummary":{"text":"Zephyr versions 2.2.0 to 4.4.2 have a vulnerability where a user-mode thread with access to a GPIO device object can perform out-of-bounds kernel writes due to unvalidated pin indices in GPIO syscall handlers. This can lead to kernel memory corruption or arbitrary code execution. The issue is only reachable in builds with CONFIG_USERSPACE=y.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:27:01.519Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-82961"}]}}