CVE-2026-17052

Executive Summary

CVE-2026-17052 is a missing-validation vulnerability in Zephyr RTOS's time-aware GPIO (TGPIO) syscall verify handler z_vrfy_tgpio_pin_read_ts_ec(), which forwards caller-controlled output pointers to the driver without performing the required K_SYSCALL_MEMORY_WRITE() check. An unprivileged user-mode thread with access to the TGPIO device object can therefore supply arbitrary addresses, and the driver performs two supervisor-mode 8-byte writes at attacker-chosen locations. Rated CVSS 7.8, the flaw yields a userspace-to-kernel write-what-where primitive enabling local privilege escalation to supervisor mode or system crash on affected Zephyr deployments.

Technical Analysis

Zephyr's syscall framework separates the user-facing syscall entry point from a privilege-separated verification handler. When CONFIG_USERSPACE is enabled, every __syscall function has a paired z_vrfy_*() handler that runs in supervisor mode and is responsible for validating each argument that crosses the user/kernel boundary before handing control to the actual driver implementation. For pointers that the kernel will write through, the correct validation is K_SYSCALL_MEMORY_WRITE(ptr, size), which confirms the address range is legitimately writable by the calling user thread.

The vulnerable handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object. It then passed the caller-supplied timestamp and event_count output pointers straight through to the driver without the K_SYSCALL_MEMORY_WRITE() check. Sibling handlers in the same file — z_vrfy_tgpio_port_get_time() and z_vrfy_tgpio_port_get_cycles_per_second() — already performed this check, establishing that the omission on this single syscall is a defect rather than a deliberate design decision.

Because tgpio_pin_read_ts_ec() is declared __syscall, any unprivileged user-mode thread holding a grant of access to the TGPIO device object can invoke it with arbitrary pointer values. The downstream implementation tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index; it does not validate the output pointers. It then unconditionally executes timestamp = ... and event_count = ..., producing two 8-byte stores in supervisor mode at addresses selected entirely by the user-mode caller.

The resulting primitive is a classic write-what-where that crosses the userspace/kernel privilege boundary. The target address is fully attacker-chosen, while the values written are the hardware time-capture and event-counter register contents — semi-controllable data whose exact values depend on when the syscall is invoked. The required capability (access to the TGPIO device object) is a narrow permission that is not intended to confer any kernel-memory write access whatsoever, so the privilege boundary is violated by design intent. The vulnerability class is CWE-787 (Out-of-bounds Write) as classified, and the missing control is specifically an absent kernel-memory-write validation in the syscall verify layer.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the mechanisms described in the NVD description.

1. Reconnaissance / target identification. The attacker must already control an unprivileged user-mode thread on a Zephyr system built with CONFIG_USERSPACE=y, the time-aware GPIO subsystem present, and the TGPIO device object exposed to that thread. Realistic context: a sandboxed application partition, a secondary thread, or a compromised lower-privilege component sharing the device with a TGPIO-enabled target. The attacker first confirms the thread can obtain/open the TGPIO device object — without that grant the syscall fails the device-object validation.

2. Triggering the flaw. The attacker invokes the tgpio_pin_read_ts_ec() syscall, providing a valid pin index (so the driver's pin-index bounds check passes) and choosing the two output-pointer arguments — timestamp and event_count — to point at kernel memory of interest. Because z_vrfy_tgpio_pin_read_ts_ec() omits K_SYSCALL_MEMORY_WRITE(), the pointers are not rejected at the verification layer even though they do not belong to the caller.

3. Payload / execution method. The syscall proceeds into tgpio_intel_read_ts_ec(), which unconditionally performs timestamp = ... and event_count = .... Both are 8-byte supervisor-mode stores to attacker-chosen addresses. The written values are the hardware time-capture and event-counter register contents; while not arbitrary, they are attacker-influenced by controlling when the read occurs (e.g., relative to counter rollover), and the addresses are fully controlled. This is the write-what-where step of the exploit.

4. Post-exploitation impact. With repeated 8-byte supervisor writes to chosen kernel addresses, an attacker can corrupt kernel data structures — for example, thread/privilege state or kernel object metadata — to escalate the calling thread to supervisor privilege, or deliberately crash the system (denial of service). Success depends on identifying a viable target address whose corruption yields a privilege or control-flow advantage, which is the standard constraint of any write-what-where primitive.

Impact Assessment

CVSS 3.1 base score is 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The Local (AV:L) and Low Privileges (PR:L) components match the requirement for an unprivileged user-mode thread that already holds TGPIO device-object access — no additional credentials or race conditions are needed, hence Low Attack Complexity (AC:L) and No User Interaction (UI:N). The High Confidentiality, Integrity, and Availability impacts reflect that supervisor-mode writes to arbitrary kernel memory can disclose kernel state opportunistically, corrupt critical structures, and panic the system. The scope is Unchanged (S:U) under the CVSS 3.1 convention used here.

Blast radius is bounded by the deployment class: Zephyr typically runs monolithic images on microcontrollers and embedded SoCs, so a successful write-what-where on a TGPIO-capable target affects the entire device image, not just the invoking thread. Devices relying on Zephyr's userspace isolation model (memory domains, application partitions) to contain untrusted or less-trusted code lose that containment guarantee. Where such a device is a safety, industrial, or connectivity component, loss of kernel integrity can translate into device malfunction, denial of service, or compromise of the wider system. EPSS is not yet scored and CISA KEV status is NO — there is no evidence of in-the-wild exploitation at this time.

Detection Guidance

Sigma Rule

title: Zephyr TGPIO Syscall Kernel Memory-Write Abuse (CVE-2026-17052)
id: 8f2c9a14-7b3d-4e51-9a6c-tgpio17052
status: experimental
description: Detects attempts to invoke tgpio_pin_read_ts_ec with out-of-range output
  pointers, indicative of the missing K_SYSCALL_MEMORY_WRITE validation (CVE-2026-17052).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-17052
author: valtersit.com
logsource:
  product: zephyr
  service: syscall_audit
detection:
  selection_syscall:
    syscall_name: 'tgpio_pin_read_ts_ec'
  selection_fault:
    event_type:
      - 'memory_write_denied'
      - 'kernel_fault'
      - 'privilege_violation'
  condition: selection_syscall and selection_fault
fields:
  - syscall_name
  - caller_thread
  - target_address
  - fault_reason
falsepositives:
  - Legitimate TGPIO usage where a device driver legitimately writes to its own memory
level: high

YARA Rule

rule CVE_2026_17052_Zephyr_TGPIO_Missing_Check
{
    meta:
        description = "Detects Zephyr TGPIO handler code lacking the K_SYSCALL_MEMORY_WRITE validation for tgpio_pin_read_ts_ec"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-17052"
        cve = "CVE-2026-17052"

    strings:
        $fn   = "z_vrfy_tgpio_pin_read_ts_ec"
        $file = "timeaware_gpio_handlers.c"
        $drv  = "tgpio_intel_read_ts_ec"
        $ok1  = "z_vrfy_tgpio_port_get_time"
        $ok2  = "z_vrfy_tgpio_port_get_cycles_per_second"
        $chk  = "K_SYSCALL_MEMORY_WRITE"

    condition:
        ($fn and $file) or $drv or
        (($ok1 or $ok2) and $file and not $chk)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-17052 Zephyr TGPIO syscall boundary-violation attempt"; flow:to_server; content:"tgpio_pin_read_ts_ec"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-17052; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-17052; sid:202617052; rev:1;)

Elastic Detection

process where event.category == "process" and
process.name like "~*zephyr*" and
message like "*tgpio_pin_read_ts_ec*" and
event.outcome in ("failure", "denied")

Splunk SPL Query

index=embedded_or_os_logs sourcetype=zephyr:syscall
| search "tgpio_pin_read_ts_ec" OR "z_vrfy_tgpio_pin_read_ts_ec"
| stats count BY host, caller_thread, target_address, event_type
| where (event_type="memory_write_denied" OR event_type="kernel_fault" OR event_type="privilege_violation") OR count > 3
| table host, caller_thread, target_address, event_type, count

Wazuh OSSEC Rule

<group name="zephyr,embedded,">
  <rule id="170521" level="10">
    <decoded_as>json</decoded_as>
    <field name="syscall_name">tgpio_pin_read_ts_ec</field>
    <description>CVE-2026-17052: Zephyr TGPIO syscall invoked with invalid or kernel target pointer</description>
    <options>no_full_log</options>
  </rule>
  <rule id="170522" level="12">
    <if_sid>170521</if_sid>
    <field name="event_type">privilege_violation</field>
    <description>CVE-2026-17052: kernel-boundary write violation via TGPIO syscall — possible privilege escalation</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Where the TGPIO subsystem is not required, disable it at build time to remove the attack surface entirely. If the feature is required, audit which user-mode threads hold access to the TGPIO device object and revoke the grant from any thread that does not strictly require it — the primitive is only reachable by a thread already granted that device-object permission. If feasible for the deployment, disabling CONFIG_USERSPACE removes the user/kernel boundary the flaw violates, though it also removes the isolation model (a trade-off, not a true fix). Monitor supervisor fault/denial logs for repeated tgpio_pin_read_ts_ec invocations with out-of-range target addresses as an early warning of active exploitation.

2. Patch / upgrade steps. No fixed version, commit hash, or vendor advisory is confirmed at this time, so no upgrade path can be specified. The corrective change described is the addition of two K_SYSCALL_MEMORY_WRITE() validations in z_vrfy_tgpio_pin_read_ts_ec(), matching the checks already present in z_vrfy_tgpio_port_get_time() and z_vrfy_tgpio_port_get_cycles_per_second(). Track upstream Zephyr advisories and apply the fix as soon as it is released; there is no vendor-supplied workaround.

3. Long-term hardening. Adopt a build-time or CI check that enforces the invariant that every __syscall verify handler validating an output pointer calls K_SYSCALL_MEMORY_WRITE() (and K_SYSCALL_MEMORY_READ() for input pointers). The fact that sibling handlers in the same file already complied while this one did not makes a lint rule the most robust defense. Enforce least privilege on device-object grants in the permission database to limit which components can reach such syscalls in the first place, and include the userspace boundary as an explicit threat-model surface for reviews of new syscall handlers.

References

• NVD — CVE-2026-17052: https://nvd.nist.gov/vuln/detail/CVE-2026-17052
• Zephyr Project security advisories and syscall framework documentation (upstream source for the affected drivers/timeaware_gpio/ handlers)
• CWE-787: Out-of-bounds Write — https://cwe.mitre.org/data/definitions/787.html
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-17052 not listed as of this writing
• FIRST EPSS — no score available for CVE-2026-17052 at the time of reporting

No public PoC, no Nuclei template, and no observed exploit-in-the-wild activity or named threat-actor campaign is associated with CVE-2026-17052 in the provided data.