CVE-2026-17052

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.5.0 and versions 3.6.0 through 4.4.0

Description The syscall verification handler z vrfy tgpio pin read ts ec() in drivers/timeaware gpio/timeaware gpio handlers.c fails to perform K SYSCALL MEMORY WRITE() checks on caller-supplied timestamp and event count output pointers. When CONFIG USERSPACE=y and CONFIG TIMEAWARE GPIO=y are enabled, an unprivileged user-mode thread with access to the TGPIO device object can provide arbitrary pointer values. This allows the tgpio intel read ts ec() function to perform two 8-byte stores in supervisor mode at addresses chosen by the user, creating a write-what-where primitive. This memory corruption can lead to a system crash or privilege escalation to supervisor level.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary mitigation, restrict access to the TGPIO device object to prevent unprivileged user-mode threads from invoking the affected syscall.