---
id: CVE-2026-17052
title: >-
  The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec()
  in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port
  device object and passed the caller-supplied timestamp and event_count output
  poin…
summary: >-
  The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec()
  in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port
  device object and passed the caller-supplied timestamp and event_count output
  poin…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: zephyrproject
product: zephyr
affected:
  - zephyr >= 3.5.0 < 4.4.2
published: '2026-09-21'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:41:24.520'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-17052'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/26264fffc17c2174319394ffa274af3f6efdc221
    label: vulnerabilities@zephyrproject.org
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8qw6-x76h-8mpc
    label: vulnerabilities@zephyrproject.org
tags:
  - nvd
  - cve.org
epss: 0.0012
epssPercentile: 0.01643
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T18:42:55.294194Z'
ingestedAt: '2026-09-21T18:50:57.567Z'
---

## Overview

The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded.

tgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values. tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index and then unconditionally performs timestamp = ... and event_count = ..., executing two 8-byte stores in supervisor mode at addresses chosen by the user-mode caller.

The result is a write-what-where primitive that crosses the userspace/kernel boundary: the target address is fully attacker-chosen and the stored values are the hardware time-capture and event-counter register contents. Corrupting kernel data structures this way can escalate the calling thread to supervisor privilege or crash the system; the device-object permission required is a narrow capability that is not intended to confer any kernel-memory access. The fix adds the two missing K_SYSCALL_MEMORY_WRITE() validations before the driver call.

Exposure is narrow in practice. Only builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y compile the affected file, and from v3.6.0 onward the file additionally referenced a relocated header (<zephyr/syscall_handler.h>) and removed Z_SYSCALL_* macros, so such a configuration failed to build until those were repaired after v4.4.0. Downstream trees that locally corrected that breakage, and v3.5.0 builds where it did not exist, are the exposed population.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.