CVE-2026-82961 — Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode
The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config() and z_vrfy_gpio_pin_interrupt_configure() verified only the device object (K_SYSCALL_DRIVER_GPIO() / K_SYSCALL_OBJ()) and then passed the caller-supplied gpio_pin_t straight through to z_impl_gpio_pin_*() and on to the driver. The only pin check in include/zephyr/drivers/gpio.h was __ASSERT(gpio_port_pin_is_supported(cfg->port_pin_mask, pin), ...), which compiles to nothing unless CONFIG_ASSERT is enabled, so in a production build no check existed at all. GPIO drivers use pin as a shift count and as an array index on the documented assumption that it is a pin the controller supports. On STM32, for example, gpio_stm32_pin_interrupt_configure() turns pin into an EXTI line and stm32_gpio_intc_set_irq_callback() writes data->cb[line_num].cb and data->cb[line_num].data into a NUM_EXTI_LINES-entry array (default 16) in drivers/interrupt_controller/intc_gpio_stm32.c, guarded only by a compiled-out __ASSERT_NO_MSG(); the same function then reads exti_irq_table[line_num] and calls irq_enable() on the result. Other controllers index fixed-size per-pin configuration tables the same way — drivers/gpio/gpio_ite_it8xxx2_v2.c reads an MMIO base pointer out of wuc_base[8] with the caller's pin and performs a read-modify-write through it. The issue is reachable only in builds with CONFIG_USERSPACE=y (the file is compiled under that symbol), by a user-mode thread that has been granted access to a GPIO device object. Such a grant is intended to authorize control of that port's pins; the missing validation instead lets the thread drive a supervisor-mode out-of-bounds write of a function pointer and an associated void * past a kernel .bss array, and out-of-bounds reads that feed irq_enable() and MMIO accesses — an escape from the user-mode sandbox that can lead to kernel memory corruption, arbitrary code execution, or a crash. The fix validates pin against the controller's gpio_driver_config.port_pin_mask with gpio_port_pin_is_supported() in every pin-taking z_vrfy_ handler and returns -EINVAL otherwise, complemented by an unconditional pin >= GPIO_MAX_PINS_PER_PORT range check added to the shared z_impl_gpio_pin_*() inlines.
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
How the score was calculated
- EPSS 0.1% (30-day exploitation probability)+0
- Technical severity (high)+6
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Zephyrproject Zephyr).
- No fix documented in the sources: reduce exposure and monitor the vendor advisory.
- Search available logs for exploit probes matching the vulnerability class (memory corruption), errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Zephyrproject | Zephyr | ≥ 2.2.0 and ≤ 4.4.2 | Vulnerable | CVE Program (cve.org) e CISA ADP |
Attack characteristics
The CVSS vector, decoded. It describes the attack, not your exposure to it.
Every base score collected
Sources score independently and may disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Scored by |
|---|---|---|---|---|---|
| 7.8 | CVSS 3.1 | High | 1.8 | 5.9 | vulnerabilities@zephyrproject.org via NIST National Vulnerability Database |
| 7.8 | CVSS 3.1 | High | — | — | zephyr via CVE Program (cve.org) e CISA ADP |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (score shown at the top: vulnerabilities@zephyrproject.org) Weakness MITRE
Weakness class according to MITRE’s CWE catalog.
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Local/physical vector: focus on endpoint telemetry (EDR) from affected hosts.
- Correlate service crashes/restarts with inbound traffic; repeated crashes may indicate attempts.
Timeline
What happened to this CVE, newest first.
- 2026
- Source status changed · Published → Awaiting Analysis
- Record published
- CVSS changed · 7.8
- Source status changed · → Published
- Record created in this database
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 1× Official description updated · Oct 28, 2026 – Oct 28, 2026
References
5 on the record
- github.com/zephyrproject-rtos/zephyr/commit/d145faab7e3a8cea62a8fd7ed5f30ef73e76
- github.com/zephyrproject-rtos/zephyr/commit/d28a05d5de4420f27ba3de7b9e4442fa056d
- github.com/zephyrproject-rtos/zephyr/commit/020e83e06b35e98a4a3c2354f67e5eee3f16
- github.com/zephyrproject-rtos/zephyr/commit/c9641fa5bfec44892e0cf2d84f78c7c60fca
- github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4f2x-8qw8-jjgf
Elsewhere on this site
Related CVEs (same products)
- Medium CVE-2026-82962 Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet 2d
- Medium CVE-2026-82388 Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host 4d
- High CVE-2026-81038 Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses 4d
- Medium CVE-2026-81039 Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity 4d
- Medium CVE-2026-82389 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference 4d
- Low CVE-2026-82390 Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver 4d
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No fixed version, patch or mitigation documented.
- No CISA SSVC assessment.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2026-82961 is "Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode", rated High. It affects Zephyr (Zephyrproject); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 7.8 describes technical severity. EPSS 0.13% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.