{"id":"CVE-2026-19947","summary":"Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer","details":"The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When CONFIG_USERSPACE is enabled, their user-mode verifiers z_vrfy_devmux_select_get() and z_vrfy_devmux_select_set() forwarded directly to the kernel implementations without performing any kernel-object validation — no k_object_access_check() and no driver object check. Compounding this, DEVICE_DT_INST_DEFINE() registered devmux instances with a NULL driver API pointer, which causes scripts/build/gen_kobject_list.py to skip them entirely, so a devmux device had no struct k_object and no permission on it could be granted or withheld in the first place.\n\nAny thread running in user mode can reach the defect: device pointers such as DEVICE_DT_GET(DT_NODELABEL(devmux0)) are compile-time constants available to application code, and the syscall accepted them from a thread that had never been granted access to the device. The kernel implementations do validate the pointer against the static devmux instance table and bounds-check the selection index, so this is not a memory-safety issue; the failure is purely one of authorization. Exposure requires CONFIG_USERSPACE=y together with the experimental CONFIG_DEVMUX=y (which depends on CONFIG_DEVICE_MUTABLE) and a zephyr,devmux devicetree node.\n\nAn unprivileged user-mode thread can read and change which downstream device a multiplexer forwards to, bypassing the userspace object-permission model. Because a devmux forwards the data, configuration and API of the selected device — its documented use being zephyr,console and zephyr,shell-uart switching — an attacker can suppress console, log and shell output, redirect that output to a downstream device it is able to observe, or flip the selection underneath another thread that is legitimately using the multiplexer. The impact is bounded to the devicetree-fixed set of downstream devices; no out-of-bounds access or arbitrary pointer dereference is reachable.\n\nThe fix declares __subsystem struct devmux_driver_api and attaches a DEVICE_API(devmux, devmux_api) instance to each devmux device so that it becomes a tracked K_OBJ_DRIVER_DEVMUX kernel object, and adds K_OOPS(devmux_inst_get(dev) == SIZE_MAX) plus K_OOPS(k_object_access_check(dev) != 0) to both verifiers.","aliases":["GHSA-8m8g-f5jf-x28x"],"modified":"2026-10-22T07:42:03.894242823Z","published":"2026-10-21T18:19:35.637Z","database_specific":{"cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19947.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"3.6.0"},{"fixed":"4.5.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}],"cna_assigner":"zephyr"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19947.json"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8m8g-f5jf-x28x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19947"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"0"},{"fixed":"4b7f98345d8f894f4b8aabe52a2623d843669fac"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"4b7f98345d8f894f4b8aabe52a2623d843669fac"}]}]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.7.99","v2.7.0-rc3","v2.7.0-rc2","v2.7.0-rc1","zephyr-v2.6.0","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","zephyr-v2.5.0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","zephyr-v2.4.0","v2.4.0","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","zephyr-v2.3.0","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","zephyr-v2.1.0","v2.1.0","zephyr-v2.2.0","v2.2.0","v2.2.0-rc3","v2.2.0-rc2","v2.2.0-rc1","v2.1.0-rc3","v2.1.0-rc2","v2.1.0-rc1","zephyr-v2.0.0","v2.0.0","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","zephyr-v1.14.0","v1.14.0","v1.14.0-rc3","v1.14.0-rc2","v1.14.0-rc1","zephyr-v1.13.0","v1.13.0","v1.13.0-rc3","v1.13.0-rc2","v1.13.0-rc1","zephyr-v1.12.0","v1.12.0","v1.12.0-rc3","v1.12.0-rc2","v1.12.0-rc1","zephyr-v1.11.0","v1.11.0","v1.11.0-rc3","v1.11.0-rc2","v1.11.0-rc1","zephyr-v1.10.0","v1.10.0","v1.10.0-rc3","v1.10.0-rc2","v1.10.0-rc1","zephyr-v1.9.0","v1.9.0","v1.9.0-rc4","v1.9.0-rc3","v1.9.0-rc2","v1.9.0-rc1","v1.8.99","zephyr-v1.5.0","v1.5.0","v1.7.99","v1.6.99","v1.5.0-rc4","v1.5.0-rc3","v1.5.0-rc2","v1.5.0-rc1","v1.5.0-rc0","zephyr-v1.4.0","v1.4.0","v1.4.0-rc3","v1.4.0-rc2","v1.4.0-rc1","zephyr-v1.3.0","v1.3.0","v1.3.0-rc2","v1.3.0-rc1","zephyr-v1.2.0","v1.2.0","v1.2.0-rc2","v1.2.0-rc1","zephyr-v1.1.0","v1.1.0","v1.1.0-rc1","zephyr-v1.0.0","v1.0.0"],"database_specific":{"vanir_signatures_modified":"2026-10-22T07:42:03Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19947.json","vanir_signatures":[{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac","target":{"file":"drivers/misc/devmux/devmux.c","function":"z_vrfy_devmux_select_set"},"deprecated":false,"digest":{"function_hash":"148531830299181059324652930051072348740","length":86},"id":"CVE-2026-19947-57b452ed","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-19947-68f4c5fa","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac","target":{"file":"include/zephyr/drivers/misc/devmux/devmux.h"},"deprecated":false,"digest":{"line_hashes":["108691657577698391629042792544935654571","76409002342487092419663925909527302448","189668668943998480318119588048355354178"],"threshold":0.9}},{"target":{"file":"drivers/misc/devmux/devmux.c"},"deprecated":false,"digest":{"line_hashes":["289586218110272944753212099143835157734","98034573165454826925129886609405253914","137760067410524941514193963018949978045","75288941879512395632411137196319404752","211099229422730164266441406074371438007","241064285857747181730267997897704835394","165786056732084874750636459852618750067","140435076406253689663105482787945794768","124380811646820082066483903837301385506","284158341892753562506675688072423451274","182689324656652368686936403593741881734","192626039280476916502211877816124437587","212720391147088549290173898297962858641","146067649663353048068234809541974132705","74701107924622340813154138175068970152","67793130531655715426352341385791589975","331172668747572275413210775155992061139","202100566226562973653668219539684774598","308096772013396751291000132282024445490","154204913449309231606661129533603523535","325953349069305432237962745607790344551","209516287308484477758537575820749821173","161306194934331033811199562263674281781","132457422516649101429413359443431983403","292490344592577311895896887911770177521"],"threshold":0.9},"id":"CVE-2026-19947-732e332c","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac"},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/4b7f98345d8f894f4b8aabe52a2623d843669fac","target":{"function":"z_vrfy_devmux_select_get","file":"drivers/misc/devmux/devmux.c"},"deprecated":false,"digest":{"function_hash":"134087146861038069845427907574047506124","length":70},"id":"CVE-2026-19947-a827483a","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}