# CVE-2026-17052: Zephyr RTOS Time-aware GPIO syscall memory write check bypass

Source: https://junglewise.ai/threats/cve-2026-17052-the-time-aware-gpio-syscall-verification-handler-z-vrfy-tgpio-pin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-17052 · Severity: high · CVSS 7.8 · Published 2026-09-21

Zephyr RTOS is a real-time operating system used in embedded and IoT devices. A flaw in the Time-aware GPIO driver's syscall handler allows an unprivileged user-mode thread with GPIO device access to write arbitrary data to kernel memory addresses, potentially escalating privileges or crashing the system. This requires enabling specific build options (CONFIG_USERSPACE and CONFIG_TIMEAWARE_GPIO) and affects only certain versions where build breakage was locally corrected or in v3.5.0 and earlier.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-17052 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17052 being exploited in the wild.

**How severe is CVE-2026-17052?** High severity, with a CVSS score of 7.8, published 21 September 2026.

**Which products and versions are affected?** Zephyr RTOS v3.5.0 and earlier; v3.6.0 to v4.4.0 (with local build fixes); potentially affected versions post-v4.4.0 if locally corrected.

**Is there a fix for CVE-2026-17052?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-17052 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-17052?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The z_vrfy_tgpio_pin_read_ts_ec() syscall handler in drivers/timeaware_gpio/timeaware_gpio_handlers.c fails to validate output pointer parameters with K_SYSCALL_MEMORY_WRITE(), unlike similar handlers in the same file. This allows a user-mode caller with TGPIO device access to supply arbitrary kernel addresses, which are then written to by tgpio_intel_read_ts_ec() in the driver, creating a write-what-where primitive. The attack requires CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y; exposure is narrowed to v3.5.0, downstream trees that locally fixed build breakage, and is absent from v4.4.0 onward unless affected builds were locally patched.

## Affected products

- Zephyr RTOS v3.5.0 and earlier; v3.6.0 to v4.4.0 (with local build fixes); potentially affected versions post-v4.4.0 if locally corrected

## Timeline

- 2026-09-21: disclosed
- 2026-09-21: advisory

## Related threats

- [Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack)
- [Zephyr RTOS PECI driver privilege escalation in peci_transfer()](https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy)
- [Zephyr Bluetooth host ATT buffer use-after-free in signed write path](https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does)
- [Zephyr Bluetooth Mesh Access layer delayable message context leak](https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in)
- [Zephyr TCP ISN derivation with all-zero key on entropy failure](https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net)