CVE-2026-17052
Received Received - Intake

Memory Corruption in Zephyr RTOS Time-Aware GPIO

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Zephyr Project

Description
The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded. tgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values. tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index and then unconditionally performs timestamp = ... and event_count = ..., executing two 8-byte stores in supervisor mode at addresses chosen by the user-mode caller. The result is a write-what-where primitive that crosses the userspace/kernel boundary: the target address is fully attacker-chosen and the stored values are the hardware time-capture and event-counter register contents. Corrupting kernel data structures this way can escalate the calling thread to supervisor privilege or crash the system; the device-object permission required is a narrow capability that is not intended to confer any kernel-memory access. The fix adds the two missing K_SYSCALL_MEMORY_WRITE() validations before the driver call. Exposure is narrow in practice. Only builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y compile the affected file, and from v3.6.0 onward the file additionally referenced a relocated header (<zephyr/syscall_handler.h>) and removed Z_SYSCALL_* macros, so such a configuration failed to build until those were repaired after v4.4.0. Downstream trees that locally corrected that breakage, and v3.5.0 builds where it did not exist, are the exposed population.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-17052
EUVD
EUVD-2026-84054

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zephyrproject zephyr From 3.5.0 (inc) to 4.4.0 (exc)
zephyrproject zephyr to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-17052 is a vulnerability in Zephyr RTOS where the syscall handler for tgpio_pin_read_ts_ec lacks proper validation of user-supplied pointers. The verification function only checks the device object but fails to validate the timestamp and event_count output pointers before passing them to the kernel driver. This allows an unprivileged userspace thread with TGPIO device access to write arbitrary 8-byte values to supervisor memory, creating a write-what-where primitive.

Detection Guidance

Detecting this vulnerability requires checking Zephyr RTOS configurations and syscall handlers. Verify if CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y are enabled in your build. Inspect the tgpio_pin_read_ts_ec syscall handler for missing K_SYSCALL_MEMORY_WRITE checks on timestamp and event_count pointers.

Impact Analysis

This vulnerability can lead to privilege escalation, where an attacker gains supervisor-level access, or system crashes due to corrupted kernel data structures. It may also allow data corruption or unauthorized memory writes. The impact depends on whether your Zephyr RTOS configuration includes CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory writes in the kernel. A write-what-where primitive may allow attackers to corrupt kernel data structures, leading to privilege escalation or system crashes. Such unauthorized access could result in data breaches or loss of integrity, which are critical concerns under GDPR and HIPAA.

Mitigation Strategies

Apply the official patch from Zephyr RTOS that adds K_SYSCALL_MEMORY_WRITE checks for the output pointers in z_vrfy_tgpio_pin_read_ts_ec. If using affected versions (3.5.0 to 4.4.1), update to version 4.4.2 or later. Disable CONFIG_TIMEAWARE_GPIO if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17052. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart