{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "drivers/gpio/gpio_emul.c",
            "drivers/gpio/gpio_handlers.c",
            "include/drivers/gpio.h",
            "include/zephyr/drivers/gpio.h"
          ],
          "programRoutines": [
            {
              "name": "z_vrfy_gpio_config"
            },
            {
              "name": "z_vrfy_gpio_pin_configure"
            },
            {
              "name": "z_vrfy_gpio_pin_get_config"
            },
            {
              "name": "z_vrfy_gpio_pin_interrupt_configure"
            }
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThanOrEqual": "4.4.2",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config() and z_vrfy_gpio_pin_interrupt_configure() verified only the device object (K_SYSCALL_DRIVER_GPIO() / K_SYSCALL_OBJ()) and then passed the caller-supplied gpio_pin_t straight through to z_impl_gpio_pin_*() and on to the driver. The only pin check in include/zephyr/drivers/gpio.h was __ASSERT(gpio_port_pin_is_supported(cfg-\u003eport_pin_mask, pin), ...), which compiles to nothing unless CONFIG_ASSERT is enabled, so in a production build no check existed at all.\n\nGPIO drivers use pin as a shift count and as an array index on the documented assumption that it is a pin the controller supports. On STM32, for example, gpio_stm32_pin_interrupt_configure() turns pin into an EXTI line and stm32_gpio_intc_set_irq_callback() writes data-\u003ecb[line_num].cb and data-\u003ecb[line_num].data into a NUM_EXTI_LINES-entry array (default 16) in drivers/interrupt_controller/intc_gpio_stm32.c, guarded only by a compiled-out __ASSERT_NO_MSG(); the same function then reads exti_irq_table[line_num] and calls irq_enable() on the result. Other controllers index fixed-size per-pin configuration tables the same way \u2014 drivers/gpio/gpio_ite_it8xxx2_v2.c reads an MMIO base pointer out of wuc_base[8] with the caller\u0027s pin and performs a read-modify-write through it.\n\nThe issue is reachable only in builds with CONFIG_USERSPACE=y (the file is compiled under that symbol), by a user-mode thread that has been granted access to a GPIO device object. Such a grant is intended to authorize control of that port\u0027s pins; the missing validation instead lets the thread drive a supervisor-mode out-of-bounds write of a function pointer and an associated void * past a kernel .bss array, and out-of-bounds reads that feed irq_enable() and MMIO accesses \u2014 an escape from the user-mode sandbox that can lead to kernel memory corruption, arbitrary code execution, or a crash.\n\nThe fix validates pin against the controller\u0027s gpio_driver_config.port_pin_mask with gpio_port_pin_is_supported() in every pin-taking z_vrfy_ handler and returns -EINVAL otherwise, complemented by an unconditional pin \u003e= GPIO_MAX_PINS_PER_PORT range check added to the shared z_impl_gpio_pin_*() inlines."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "bounds",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:58:58.927Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "name": "Fix commit 020e83e06b35",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/020e83e06b35e98a4a3c2354f67e5eee3f163363"
        },
        {
          "name": "Fix commit d145faab7e3a",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/d145faab7e3a8cea62a8fd7ed5f30ef73e762f59"
        },
        {
          "name": "Fix commit c9641fa5bfec",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/c9641fa5bfec44892e0cf2d84f78c7c60fca8ad6"
        },
        {
          "name": "Fix commit d28a05d5de44",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/d28a05d5de4420f27ba3de7b9e4442fa056d51de"
        },
        {
          "name": "GHSA-4f2x-8qw8-jjgf",
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4f2x-8qw8-jjgf"
        }
      ],
      "title": "Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2026-82961",
    "datePublished": "2026-10-28T16:58:58.927Z",
    "dateReserved": "2026-08-31T13:10:32.703Z",
    "dateUpdated": "2026-10-28T16:58:58.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}