Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-17052

CVE-2026-17052: Zephyr RTOS Privilege Escalation Vulnerability

CVE-2026-17052 is a privilege escalation flaw in Zephyr RTOS that allows unprivileged threads to write to arbitrary kernel memory through Time-aware GPIO syscalls. This article covers technical details, affected configurations, and mitigation.

Published:

CVE-2026-17052 Overview

CVE-2026-17052 is a missing memory-validation flaw in the Zephyr RTOS Time-aware GPIO (TGPIO) syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() located in drivers/timeaware_gpio/timeaware_gpio_handlers.c. The handler validated the port device object but forgot to call K_SYSCALL_MEMORY_WRITE() on the caller-supplied timestamp and event_count output pointers. An unprivileged user-mode thread granted access to the TGPIO device object can invoke the syscall with attacker-chosen pointers, producing a write-what-where primitive across the userspace/kernel boundary. The classification is [CWE-787] Out-of-Bounds Write.

Critical Impact

A local user-mode thread with TGPIO device access can force two 8-byte supervisor-mode writes to arbitrary kernel addresses, enabling privilege escalation or full system compromise.

Affected Products

  • Zephyr RTOS builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y
  • Zephyr v3.5.0 branches shipping drivers/timeaware_gpio/timeaware_gpio_handlers.c
  • Downstream Zephyr forks that locally repaired the post-v3.6.0 build break referencing <zephyr/syscall_handler.h> prior to the fix landing after v4.4.0

Discovery Timeline

  • 2026-09-21 - CVE-2026-17052 published to NVD
  • 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-17052

Vulnerability Analysis

The Time-aware GPIO subsystem exposes tgpio_pin_read_ts_ec() as a Zephyr syscall via the __syscall marker. When CONFIG_USERSPACE=y is enabled, syscalls entered from user mode traverse a verification handler prefixed z_vrfy_ that must validate every caller-supplied pointer before invoking the supervisor-mode implementation. Sibling handlers z_vrfy_tgpio_port_get_time() and z_vrfy_tgpio_port_get_cycles_per_second() correctly guard their output pointers with K_SYSCALL_MEMORY_WRITE(). The z_vrfy_tgpio_pin_read_ts_ec() handler omitted both checks and passed the raw timestamp and event_count pointers straight to the driver.

The underlying driver routine tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index. It then unconditionally executes *timestamp = ... and *event_count = ..., performing two 8-byte stores in supervisor mode at attacker-selected addresses. The stored values are the hardware time-capture register and event-counter register contents.

Root Cause

The root cause is missing input validation in a privileged syscall boundary. The handler trusted user-mode pointers without invoking Zephyr's K_SYSCALL_MEMORY_WRITE() macro that verifies the target buffer lies within a memory region writable by the calling thread. This is a canonical [CWE-787] out-of-bounds write introduced by an oversight relative to peer handlers in the same file.

Attack Vector

Exploitation requires local access as an unprivileged user-mode thread that has been granted the TGPIO device object capability. The attacker crafts a syscall invocation supplying kernel addresses for timestamp and event_count. The kernel writes 8 bytes of hardware register content to each address. Targeting kernel data structures such as thread privilege flags, syscall dispatch tables, or function pointers enables escalation to supervisor mode or induces a controlled crash. The TGPIO device capability alone is not intended to grant any kernel-memory access.

c
// Patch: drivers/timeaware_gpio/timeaware_gpio_handlers.c
// Adds the two missing K_SYSCALL_MEMORY_WRITE() validations
					       uint64_t *timestamp, uint64_t *event_count)
 {
 	K_OOPS(K_SYSCALL_DRIVER_TGPIO(port, read_ts_ec));
+	K_OOPS(K_SYSCALL_MEMORY_WRITE(timestamp, sizeof(uint64_t)));
+	K_OOPS(K_SYSCALL_MEMORY_WRITE(event_count, sizeof(uint64_t)));
 	return z_impl_tgpio_pin_read_ts_ec((const struct device *)port, pin, (uint64_t *)timestamp,
 					    (uint64_t *)event_count);
 }

Source: GitHub Zephyr Commit 26264ff

Detection Methods for CVE-2026-17052

Indicators of Compromise

  • Unexpected K_OOPS fatal errors originating from z_vrfy_tgpio_pin_read_ts_ec() after patching, indicating prior probing attempts by user-mode threads
  • User-mode threads with TGPIO device capability making frequent or malformed calls to tgpio_pin_read_ts_ec()
  • Kernel panics or unexplained supervisor-mode faults on devices exposing TGPIO to userspace applications

Detection Strategies

  • Perform a source audit of any downstream Zephyr tree for the presence of K_SYSCALL_MEMORY_WRITE() calls inside z_vrfy_tgpio_pin_read_ts_ec() before the driver invocation
  • Enumerate firmware builds with both CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y set, and confirm whether the fix commit 26264ff is included
  • Review thread permission grants to identify user-mode threads that hold access to the TGPIO device object

Monitoring Recommendations

  • Enable Zephyr fault handlers and log kernel oops events to a persistent store for post-incident review
  • Instrument TGPIO syscall entry points with counters or trace hooks to detect anomalous call frequency from user-mode threads
  • Track firmware supply-chain metadata to flag deployed images built from vulnerable Zephyr commits

How to Mitigate CVE-2026-17052

Immediate Actions Required

  • Apply Zephyr upstream commit 26264fffc17c2174319394ffa274af3f6efdc221 to any downstream branch that includes drivers/timeaware_gpio/timeaware_gpio_handlers.c
  • Rebuild and redeploy all firmware images that ship with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y
  • Audit device-object permission grants and revoke TGPIO access from user-mode threads that do not require it

Patch Information

The fix adds two K_SYSCALL_MEMORY_WRITE() validations for the timestamp and event_count output pointers before invoking z_impl_tgpio_pin_read_ts_ec(). Full details are available in the Zephyr Security Advisory GHSA-8qw6-x76h-8mpc and the upstream patch commit.

Workarounds

  • Disable the Time-aware GPIO driver by unsetting CONFIG_TIMEAWARE_GPIO if the application does not require it
  • Disable user-mode support by unsetting CONFIG_USERSPACE in builds that can operate entirely in supervisor mode
  • Restrict TGPIO device-object permissions so that no user-mode thread receives the capability required to invoke the vulnerable syscall
bash
# Configuration example: disable the vulnerable driver in prj.conf
CONFIG_TIMEAWARE_GPIO=n

# Or, if TGPIO is required, ensure userspace is disabled
CONFIG_USERSPACE=n

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne