Unauthorized Access Vulnerability in Device Multiplexer Driver by Zephyr Project

CVE-2026-19947

What is CVE-2026-19947?

The device multiplexer pseudo-driver in the Zephyr Project exposes critical system calls that can be exploited by unprivileged user-mode threads. When CONFIG_USERSPACE is enabled, these system calls allow users to interact with devices without adequate permission checks, bypassing the established userspace object-permission model. Attackers can redirect outputs intended for console and shell, leading to potential information leaks or disruptions in service. This vulnerability stems from misconfigurations during device instance registration, resulting in a lack of kernel-object validation that would normally prevent unauthorized access.

References