# CVE-2026-19947: Zephyr device multiplexer privilege escalation in devmux

Source: https://junglewise.ai/threats/cve-2026-19947-the-device-multiplexer-pseudo-driver-in-drivers-misc-devmux  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-19947 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Zephyr's device multiplexer driver allows unprivileged user-mode threads to bypass access controls and redirect data between downstream devices without authorization. An attacker can suppress or redirect console, log, and shell output by switching which device a multiplexer forwards to, potentially disrupting legitimate system operations or exfiltrating sensitive output.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-19947 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19947 being exploited in the wild.

**How severe is CVE-2026-19947?** Medium severity, with a CVSS score of 5.3, published 21 October 2026.

**Which products and versions are affected?** Zephyr Project Zephyr RTOS versions with CONFIG_DEVMUX=y enabled.

**Is there a fix for CVE-2026-19947?** Yes: fixed in Versions that include the fix declaring __subsystem struct devmux_driver_api and adding K_OOPS() checks in verifiers (version not specified in advisory). Until then: Disable CONFIG_DEVMUX in kernel configuration or ensure CONFIG_USERSPACE is not enabled if CONFIG_DEVMUX must remain active, since the vulnerability is only exploitable when userspace object permissions are in effect. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19947 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-19947?** Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Versions that include the fix declaring __subsystem struct devmux_driver_api and adding K_OOPS() checks in verifiers (version not specified in advisory)

Disable CONFIG_DEVMUX in kernel configuration or ensure CONFIG_USERSPACE is not enabled if CONFIG_DEVMUX must remain active, since the vulnerability is only exploitable when userspace object permissions are in effect.

## Technical details

The devmux pseudo-driver's user-mode verifiers z_vrfy_devmux_select_get() and z_vrfy_devmux_select_set() fail to perform k_object_access_check() before forwarding syscalls to kernel implementations, and devmux instances lack kernel object structures due to NULL driver API pointers. An unprivileged user-mode thread can invoke devmux_select_set() with compile-time-constant device pointers to redirect the multiplexer's selection to any downstream device in the devicetree, bypassing the userspace permission model. Exploitation requires CONFIG_USERSPACE=y and CONFIG_DEVMUX=y.

## Affected products

- Zephyr Project Zephyr RTOS versions with CONFIG_DEVMUX=y enabled

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a)
- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random)
- [Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter)
- [Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not)