CVE-2026-19947

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19947
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19947.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19947
Aliases
  • GHSA-8m8g-f5jf-x28x
Published
2026-10-21T18:19:35Z
Modified
2026-11-04T13:05:07Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer
Details

The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When CONFIG_USERSPACE is enabled, their user-mode verifiers z_vrfy_devmux_select_get() and z_vrfy_devmux_select_set() forwarded directly to the kernel implementations without performing any kernel-object validation — no k_object_access_check() and no driver object check. Compounding this, DEVICE_DT_INST_DEFINE() registered devmux instances with a NULL driver API pointer, which causes scripts/build/gen_kobject_list.py to skip them entirely, so a devmux device had no struct k_object and no permission on it could be granted or withheld in the first place.

Any thread running in user mode can reach the defect: device pointers such as DEVICE_DT_GET(DT_NODELABEL(devmux0)) are compile-time constants available to application code, and the syscall accepted them from a thread that had never been granted access to the device. The kernel implementations do validate the pointer against the static devmux instance table and bounds-check the selection index, so this is not a memory-safety issue; the failure is purely one of authorization. Exposure requires CONFIG_USERSPACE=y together with the experimental CONFIG_DEVMUX=y (which depends on CONFIG_DEVICE_MUTABLE) and a zephyr,devmux devicetree node.

An unprivileged user-mode thread can read and change which downstream device a multiplexer forwards to, bypassing the userspace object-permission model. Because a devmux forwards the data, configuration and API of the selected device — its documented use being zephyr,console and zephyr,shell-uart switching — an attacker can suppress console, log and shell output, redirect that output to a downstream device it is able to observe, or flip the selection underneath another thread that is legitimately using the multiplexer. The impact is bounded to the devicetree-fixed set of downstream devices; no out-of-bounds access or arbitrary pointer dereference is reachable.

The fix declares __subsystem struct devmux_driver_api and attaches a DEVICE_API(devmux, devmux_api) instance to each devmux device so that it becomes a tracked K_OBJ_DRIVER_DEVMUX kernel object, and adds K_OOPS(devmux_inst_get(dev) == SIZE_MAX) plus K_OOPS(k_object_access_check(dev) != 0) to both verifiers.

Database specific 
{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19947.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
468eb56cf242eedba62006ee758700ee6148763f
Fixed
41d10b59730406bbab4ca9f1fbbe9e96aafb4966
Fixed
4b7f98345d8f894f4b8aabe52a2623d843669fac
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.6.0"
                },
                {
                    "fixed": "4.5.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "4b7f98345d8f894f4b8aabe52a2623d843669fac"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v3.*
v3.6.0
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19947.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "148531830299181059324652930051072348740",
            "length": 86
        },
        "id": "CVE-2026-19947-57b452ed",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac",
        "target": {
            "file": "drivers/misc/devmux/devmux.c",
            "function": "z_vrfy_devmux_select_set"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "108691657577698391629042792544935654571",
                "76409002342487092419663925909527302448",
                "189668668943998480318119588048355354178"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19947-68f4c5fa",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac",
        "target": {
            "file": "include/zephyr/drivers/misc/devmux/devmux.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "289586218110272944753212099143835157734",
                "98034573165454826925129886609405253914",
                "137760067410524941514193963018949978045",
                "75288941879512395632411137196319404752",
                "211099229422730164266441406074371438007",
                "241064285857747181730267997897704835394",
                "165786056732084874750636459852618750067",
                "140435076406253689663105482787945794768",
                "124380811646820082066483903837301385506",
                "284158341892753562506675688072423451274",
                "182689324656652368686936403593741881734",
                "192626039280476916502211877816124437587",
                "212720391147088549290173898297962858641",
                "146067649663353048068234809541974132705",
                "74701107924622340813154138175068970152",
                "67793130531655715426352341385791589975",
                "331172668747572275413210775155992061139",
                "202100566226562973653668219539684774598",
                "308096772013396751291000132282024445490",
                "154204913449309231606661129533603523535",
                "325953349069305432237962745607790344551",
                "209516287308484477758537575820749821173",
                "161306194934331033811199562263674281781",
                "132457422516649101429413359443431983403",
                "292490344592577311895896887911770177521"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19947-732e332c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac",
        "target": {
            "file": "drivers/misc/devmux/devmux.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "134087146861038069845427907574047506124",
            "length": 70
        },
        "id": "CVE-2026-19947-a827483a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac",
        "target": {
            "file": "drivers/misc/devmux/devmux.c",
            "function": "z_vrfy_devmux_select_get"
        }
    }
]
vanir_signatures_modified 
"2026-11-04T13:05:07Z"