CVE-2026-17052 zephyrproject CVE debrief

Who should care

System administrators and developers using the Zephyr operating system with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y configurations should review and apply patches, verify configuration settings, and monitor system logs for potential exploitation attempts. Additionally, security teams and vulnerability management teams should be aware of the potential risks and take necessary precautions to prevent exploitation.

Why it matters

The vulnerability allows an unprivileged user-mode thread to corrupt kernel data structures, potentially leading to privilege escalation or system instability. Defenders should review and apply patches, verify configuration settings, and monitor system logs for potential exploitation attempts.

• Potential privilege escalation to supervisor mode
• System crash or instability due to kernel data structure corruption
• Unauthorized modification of kernel memory

Technical summary

The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded. tgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch from the Zephyr project repository
• Verify that the CONFIG_USERSPACE and CONFIG_TIMEAWARE_GPIO configurations are not enabled in your build
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a missing K_SYSCALL_MEMORY_WRITE() check in the z_vrfy_tgpio_pin_read_ts_ec() function, which allows an attacker to write arbitrary values to kernel memory. The affected code is only present in builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.