{"id":"CVE-2026-19947","state":"PUBLISHED","title":"Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer","description":"The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When CONFIG_USERSPACE is enabled, their user-mode verifiers z_vrfy_devmux_select_get() and z_vrfy_devmux_select_set() forwarded directly to the kernel implementations without performing any kernel-object validation — no k_object_access_check() and no driver object check. Compounding this, DEVICE_DT_INST_DEFINE() registered devmux instances with a NULL driver API pointer, which causes scripts/build/gen_kobject_list.py to skip them entirely, so a devmux device had no struct k_object and no permission on it could be granted or withheld in the first place.\n\nAny thread running in user mode can reach the defect: device pointers such as DEVICE_DT_GET(DT_NODELABEL(devmux0)) are compile-time constants available to application code, and the syscall accepted them from a thread that had never been granted access to the device. The kernel implementations do validate the pointer against the static devmux instance table and bounds-check the selection index, so this is not a memory-safety issue; the failure is purely one of authorization. Exposure requires CONFIG_USERSPACE=y together with the experimental CONFIG_DEVMUX=y (which depends on CONFIG_DEVICE_MUTABLE) and a zephyr,devmux devicetree node.\n\nAn unprivileged user-mode thread can read and change which downstream device a multiplexer forwards to, bypassing the userspace object-permission model. Because a devmux forwards the data, configuration and API of the selected device — its documented use being zephyr,console and zephyr,shell-uart switching — an attacker can suppress console, log and shell output, redirect that output to a downstream device it is able to observe, or flip the selection underneath another thread that is legitimately using the multiplexer. The impact is bounded to the devicetree-fixed set of downstream devices; no out-of-bounds access or arbitrary pointer dereference is reachable.\n\nThe fix declares __subsystem struct devmux_driver_api and attaches a DEVICE_API(devmux, devmux_api) instance to each devmux device so that it becomes a tracked K_OBJ_DRIVER_DEVMUX kernel object, and adds K_OOPS(devmux_inst_get(dev) == SIZE_MAX) plus K_OOPS(k_object_access_check(dev) != 0) to both verifiers.","publishedAt":"2026-10-21T18:19:35.637Z","updatedAt":"2026-10-23T21:23:27.801Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","source":"zephyr"},"assigner":"zephyr","products":["zephyrproject zephyr"],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"3.6.0","status":"affected","lessThan":"4.5.0","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["drivers/misc/devmux/devmux.c","include/zephyr/drivers/misc/devmux/devmux.h"],"programRoutines":[{"name":"z_vrfy_devmux_select_get"},{"name":"z_vrfy_devmux_select_set"}]}],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8m8g-f5jf-x28x"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19947.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19947","state":"PUBLISHED","datePublished":"2026-10-21T18:19:35.637Z","dateUpdated":"2026-10-23T21:23:27.801Z","assignerShortName":"zephyr","assignerOrgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateReserved":"2026-08-15T18:43:26.567Z"},"containers":{"cna":{"title":"Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer","descriptions":[{"lang":"en","value":"The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When CONFIG_USERSPACE is enabled, their user-mode verifiers z_vrfy_devmux_select_get() and z_vrfy_devmux_select_set() forwarded directly to the kernel implementations without performing any kernel-object validation — no k_object_access_check() and no driver object check. Compounding this, DEVICE_DT_INST_DEFINE() registered devmux instances with a NULL driver API pointer, which causes scripts/build/gen_kobject_list.py to skip them entirely, so a devmux device had no struct k_object and no permission on it could be granted or withheld in the first place.\n\nAny thread running in user mode can reach the defect: device pointers such as DEVICE_DT_GET(DT_NODELABEL(devmux0)) are compile-time constants available to application code, and the syscall accepted them from a thread that had never been granted access to the device. The kernel implementations do validate the pointer against the static devmux instance table and bounds-check the selection index, so this is not a memory-safety issue; the failure is purely one of authorization. Exposure requires CONFIG_USERSPACE=y together with the experimental CONFIG_DEVMUX=y (which depends on CONFIG_DEVICE_MUTABLE) and a zephyr,devmux devicetree node.\n\nAn unprivileged user-mode thread can read and change which downstream device a multiplexer forwards to, bypassing the userspace object-permission model. Because a devmux forwards the data, configuration and API of the selected device — its documented use being zephyr,console and zephyr,shell-uart switching — an attacker can suppress console, log and shell output, redirect that output to a downstream device it is able to observe, or flip the selection underneath another thread that is legitimately using the multiplexer. The impact is bounded to the devicetree-fixed set of downstream devices; no out-of-bounds access or arbitrary pointer dereference is reachable.\n\nThe fix declares __subsystem struct devmux_driver_api and attaches a DEVICE_API(devmux, devmux_api) instance to each devmux device so that it becomes a tracked K_OBJ_DRIVER_DEVMUX kernel object, and adds K_OOPS(devmux_inst_get(dev) == SIZE_MAX) plus K_OOPS(k_object_access_check(dev) != 0) to both verifiers."}],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"3.6.0","status":"affected","lessThan":"4.5.0","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["drivers/misc/devmux/devmux.c","include/zephyr/drivers/misc/devmux/devmux.h"],"programRoutines":[{"name":"z_vrfy_devmux_select_get"},{"name":"z_vrfy_devmux_select_set"}]}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac","name":"Fix commit","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8m8g-f5jf-x28x","name":"GHSA-8m8g-f5jf-x28x"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"auth","type":"CWE"}]}],"providerMetadata":{"shortName":"zephyr","orgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateUpdated":"2026-10-21T18:19:35.637Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-23T20:43:43.520419Z","id":"CVE-2026-19947","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-23T21:23:27.801Z"}}]}}}