CVE-2026-19947
- Source
- https://cve.org/CVERecord?id=CVE-2026-19947
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19947.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-19947
- Aliases
-
- GHSA-8m8g-f5jf-x28x
- Published
- 2026-10-21T18:19:35Z
- Modified
- 2026-10-22T07:42:03Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer
- Details
-
The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When CONFIG_USERSPACE is enabled, their user-mode verifiers z_vrfy_devmux_select_get() and z_vrfy_devmux_select_set() forwarded directly to the kernel implementations without performing any kernel-object validation — no k_object_access_check() and no driver object check. Compounding this, DEVICE_DT_INST_DEFINE() registered devmux instances with a NULL driver API pointer, which causes scripts/build/gen_kobject_list.py to skip them entirely, so a devmux device had no struct k_object and no permission on it could be granted or withheld in the first place.
Any thread running in user mode can reach the defect: device pointers such as DEVICE_DT_GET(DT_NODELABEL(devmux0)) are compile-time constants available to application code, and the syscall accepted them from a thread that had never been granted access to the device. The kernel implementations do validate the pointer against the static devmux instance table and bounds-check the selection index, so this is not a memory-safety issue; the failure is purely one of authorization. Exposure requires CONFIG_USERSPACE=y together with the experimental CONFIG_DEVMUX=y (which depends on CONFIG_DEVICE_MUTABLE) and a zephyr,devmux devicetree node.
An unprivileged user-mode thread can read and change which downstream device a multiplexer forwards to, bypassing the userspace object-permission model. Because a devmux forwards the data, configuration and API of the selected device — its documented use being zephyr,console and zephyr,shell-uart switching — an attacker can suppress console, log and shell output, redirect that output to a downstream device it is able to observe, or flip the selection underneath another thread that is legitimately using the multiplexer. The impact is bounded to the devicetree-fixed set of downstream devices; no out-of-bounds access or arbitrary pointer dereference is reachable.
The fix declares __subsystem struct devmux_driver_api and attaches a DEVICE_API(devmux, devmux_api) instance to each devmux device so that it becomes a tracked K_OBJ_DRIVER_DEVMUX kernel object, and adds K_OOPS(devmux_inst_get(dev) == SIZE_MAX) plus K_OOPS(k_object_access_check(dev) != 0) to both verifiers.
- Database specific
{ "cna_assigner": "zephyr", "cwe_ids": [ "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19947.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "3.6.0" }, { "fixed": "4.5.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19947.json
- https://github.com/zephyrproject-rtos/zephyr
- https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8m8g-f5jf-x28x
- https://nvd.nist.gov/vuln/detail/CVE-2026-19947
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected ranges
- Type
- GIT
- Repo
- https://github.com/zephyrproject-rtos/zephyr
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "fixed": "4b7f98345d8f894f4b8aabe52a2623d843669fac" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
v1.*
v2.*
v3.*
v4.*
zephyr-v1.*
zephyr-v2.*
zephyr-v3.*
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19947.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "148531830299181059324652930051072348740",
"length": 86
},
"id": "CVE-2026-19947-57b452ed",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac",
"target": {
"file": "drivers/misc/devmux/devmux.c",
"function": "z_vrfy_devmux_select_set"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"108691657577698391629042792544935654571",
"76409002342487092419663925909527302448",
"189668668943998480318119588048355354178"
],
"threshold": 0.9
},
"id": "CVE-2026-19947-68f4c5fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac",
"target": {
"file": "include/zephyr/drivers/misc/devmux/devmux.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"289586218110272944753212099143835157734",
"98034573165454826925129886609405253914",
"137760067410524941514193963018949978045",
"75288941879512395632411137196319404752",
"211099229422730164266441406074371438007",
"241064285857747181730267997897704835394",
"165786056732084874750636459852618750067",
"140435076406253689663105482787945794768",
"124380811646820082066483903837301385506",
"284158341892753562506675688072423451274",
"182689324656652368686936403593741881734",
"192626039280476916502211877816124437587",
"212720391147088549290173898297962858641",
"146067649663353048068234809541974132705",
"74701107924622340813154138175068970152",
"67793130531655715426352341385791589975",
"331172668747572275413210775155992061139",
"202100566226562973653668219539684774598",
"308096772013396751291000132282024445490",
"154204913449309231606661129533603523535",
"325953349069305432237962745607790344551",
"209516287308484477758537575820749821173",
"161306194934331033811199562263674281781",
"132457422516649101429413359443431983403",
"292490344592577311895896887911770177521"
],
"threshold": 0.9
},
"id": "CVE-2026-19947-732e332c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac",
"target": {
"file": "drivers/misc/devmux/devmux.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "134087146861038069845427907574047506124",
"length": 70
},
"id": "CVE-2026-19947-a827483a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac",
"target": {
"file": "drivers/misc/devmux/devmux.c",
"function": "z_vrfy_devmux_select_get"
}
}
]
vanir_signatures_modified
"2026-10-22T07:42:03Z"