Unprivileged Access Vulnerability in Zephyr Time-aware GPIO Driver

CVE-2026-17052

What is CVE-2026-17052?

The vulnerability in the Zephyr Time-aware GPIO driver allows unprivileged user-mode threads to invoke a syscall with arbitrary pointer values, potentially escalating privileges or crashing the system. This issue arises from a lack of proper memory validation in the syscall handler, leaving it unguarded compared to other handlers in the same module. Although the practical exposure is narrowed by specific build conditions, it is essential for users of the affected versions to implement the necessary patches to mitigate risks.

References