{"id":"CVE-2026-82961","state":"PUBLISHED","title":"Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode","description":"The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config() and z_vrfy_gpio_pin_interrupt_configure() verified only the device object (K_SYSCALL_DRIVER_GPIO() / K_SYSCALL_OBJ()) and then passed the caller-supplied gpio_pin_t straight through to z_impl_gpio_pin_*() and on to the driver. The only pin check in include/zephyr/drivers/gpio.h was __ASSERT(gpio_port_pin_is_supported(cfg->port_pin_mask, pin), ...), which compiles to nothing unless CONFIG_ASSERT is enabled, so in a production build no check existed at all.\n\nGPIO drivers use pin as a shift count and as an array index on the documented assumption that it is a pin the controller supports. On STM32, for example, gpio_stm32_pin_interrupt_configure() turns pin into an EXTI line and stm32_gpio_intc_set_irq_callback() writes data->cb[line_num].cb and data->cb[line_num].data into a NUM_EXTI_LINES-entry array (default 16) in drivers/interrupt_controller/intc_gpio_stm32.c, guarded only by a compiled-out __ASSERT_NO_MSG(); the same function then reads exti_irq_table[line_num] and calls irq_enable() on the result. Other controllers index fixed-size per-pin configuration tables the same way — drivers/gpio/gpio_ite_it8xxx2_v2.c reads an MMIO base pointer out of wuc_base[8] with the caller's pin and performs a read-modify-write through it.\n\nThe issue is reachable only in builds with CONFIG_USERSPACE=y (the file is compiled under that symbol), by a user-mode thread that has been granted access to a GPIO device object. Such a grant is intended to authorize control of that port's pins; the missing validation instead lets the thread drive a supervisor-mode out-of-bounds write of a function pointer and an associated void * past a kernel .bss array, and out-of-bounds reads that feed irq_enable() and MMIO accesses — an escape from the user-mode sandbox that can lead to kernel memory corruption, arbitrary code execution, or a crash.\n\nThe fix validates pin against the controller's gpio_driver_config.port_pin_mask with gpio_port_pin_is_supported() in every pin-taking z_vrfy_ handler and returns -EINVAL otherwise, complemented by an unconditional pin >= GPIO_MAX_PINS_PER_PORT range check added to the shared z_impl_gpio_pin_*() inlines.","publishedAt":"2026-10-28T16:58:58.927Z","updatedAt":"2026-10-28T16:58:58.927Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"zephyr"},"assigner":"zephyr","products":["zephyrproject zephyr"],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"2.2.0","status":"affected","lessThanOrEqual":"4.4.2","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["drivers/gpio/gpio_emul.c","drivers/gpio/gpio_handlers.c","include/drivers/gpio.h","include/zephyr/drivers/gpio.h"],"programRoutines":[{"name":"z_vrfy_gpio_config"},{"name":"z_vrfy_gpio_pin_configure"},{"name":"z_vrfy_gpio_pin_get_config"},{"name":"z_vrfy_gpio_pin_interrupt_configure"}]}],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/020e83e06b35e98a4a3c2354f67e5eee3f163363","https://github.com/zephyrproject-rtos/zephyr/commit/d145faab7e3a8cea62a8fd7ed5f30ef73e762f59","https://github.com/zephyrproject-rtos/zephyr/commit/c9641fa5bfec44892e0cf2d84f78c7c60fca8ad6","https://github.com/zephyrproject-rtos/zephyr/commit/d28a05d5de4420f27ba3de7b9e4442fa056d51de","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4f2x-8qw8-jjgf"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82961.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82961","state":"PUBLISHED","datePublished":"2026-10-28T16:58:58.927Z","dateUpdated":"2026-10-28T16:58:58.927Z","assignerShortName":"zephyr","assignerOrgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateReserved":"2026-08-31T13:10:32.703Z"},"containers":{"cna":{"title":"Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode","descriptions":[{"lang":"en","value":"The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config() and z_vrfy_gpio_pin_interrupt_configure() verified only the device object (K_SYSCALL_DRIVER_GPIO() / K_SYSCALL_OBJ()) and then passed the caller-supplied gpio_pin_t straight through to z_impl_gpio_pin_*() and on to the driver. The only pin check in include/zephyr/drivers/gpio.h was __ASSERT(gpio_port_pin_is_supported(cfg->port_pin_mask, pin), ...), which compiles to nothing unless CONFIG_ASSERT is enabled, so in a production build no check existed at all.\n\nGPIO drivers use pin as a shift count and as an array index on the documented assumption that it is a pin the controller supports. On STM32, for example, gpio_stm32_pin_interrupt_configure() turns pin into an EXTI line and stm32_gpio_intc_set_irq_callback() writes data->cb[line_num].cb and data->cb[line_num].data into a NUM_EXTI_LINES-entry array (default 16) in drivers/interrupt_controller/intc_gpio_stm32.c, guarded only by a compiled-out __ASSERT_NO_MSG(); the same function then reads exti_irq_table[line_num] and calls irq_enable() on the result. Other controllers index fixed-size per-pin configuration tables the same way — drivers/gpio/gpio_ite_it8xxx2_v2.c reads an MMIO base pointer out of wuc_base[8] with the caller's pin and performs a read-modify-write through it.\n\nThe issue is reachable only in builds with CONFIG_USERSPACE=y (the file is compiled under that symbol), by a user-mode thread that has been granted access to a GPIO device object. Such a grant is intended to authorize control of that port's pins; the missing validation instead lets the thread drive a supervisor-mode out-of-bounds write of a function pointer and an associated void * past a kernel .bss array, and out-of-bounds reads that feed irq_enable() and MMIO accesses — an escape from the user-mode sandbox that can lead to kernel memory corruption, arbitrary code execution, or a crash.\n\nThe fix validates pin against the controller's gpio_driver_config.port_pin_mask with gpio_port_pin_is_supported() in every pin-taking z_vrfy_ handler and returns -EINVAL otherwise, complemented by an unconditional pin >= GPIO_MAX_PINS_PER_PORT range check added to the shared z_impl_gpio_pin_*() inlines."}],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"2.2.0","status":"affected","lessThanOrEqual":"4.4.2","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["drivers/gpio/gpio_emul.c","drivers/gpio/gpio_handlers.c","include/drivers/gpio.h","include/zephyr/drivers/gpio.h"],"programRoutines":[{"name":"z_vrfy_gpio_config"},{"name":"z_vrfy_gpio_pin_configure"},{"name":"z_vrfy_gpio_pin_get_config"},{"name":"z_vrfy_gpio_pin_interrupt_configure"}]}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/020e83e06b35e98a4a3c2354f67e5eee3f163363","name":"Fix commit 020e83e06b35","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/d145faab7e3a8cea62a8fd7ed5f30ef73e762f59","name":"Fix commit d145faab7e3a","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/c9641fa5bfec44892e0cf2d84f78c7c60fca8ad6","name":"Fix commit c9641fa5bfec","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/d28a05d5de4420f27ba3de7b9e4442fa056d51de","name":"Fix commit d28a05d5de44","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4f2x-8qw8-jjgf","name":"GHSA-4f2x-8qw8-jjgf"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","description":"bounds","type":"CWE"}]}],"providerMetadata":{"shortName":"zephyr","orgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateUpdated":"2026-10-28T16:58:58.927Z"},"x_generator":{"engine":"cvelib 1.8.0"}}}}}