Is CVE-2026-82961 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82961 being exploited in the wild.

How severe is CVE-2026-82961?

High severity, with a CVSS score of 7.8, published 28 October 2026.

Is there a fix for CVE-2026-82961?

Yes: fixed in . Until then: Disable CONFIG_USERSPACE or restrict GPIO device grants to trusted user-mode threads only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82961 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-82961?

Check whether you run Zephyr Project Zephyr RTOS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82961: Zephyr GPIO syscall pin validation bypass

CVE-2026-82961 · Severity: high · CVSS 7.8 · Published 2026-10-28

Zephyr's GPIO driver interface, used to control electrical pins on embedded systems, failed to validate pin numbers from user-mode applications. A malicious user-mode thread with GPIO access could supply an invalid pin number to trigger out-of-bounds memory writes and reads in kernel space, potentially corrupting kernel data, executing arbitrary code, or crashing the system.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-82961 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82961 being exploited in the wild.
How severe is CVE-2026-82961?: High severity, with a CVSS score of 7.8, published 28 October 2026.
Which products and versions are affected?: Zephyr Project Zephyr RTOS.
Is there a fix for CVE-2026-82961?: Yes: fixed in <UNKNOWN>. Until then: Disable CONFIG_USERSPACE or restrict GPIO device grants to trusted user-mode threads only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82961 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-82961?: Check whether you run Zephyr Project Zephyr RTOS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: <UNKNOWN>

Disable CONFIG_USERSPACE or restrict GPIO device grants to trusted user-mode threads only.

Technical details

The z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config(), and z_vrfy_gpio_pin_interrupt_configure() syscall handlers in drivers/gpio/gpio_handlers.c validated the GPIO device object but not the pin argument, passing caller-supplied pin values directly to driver implementations. GPIO drivers use the pin as both a shift count and array index into fixed-size tables, causing out-of-bounds writes to function pointer callbacks and MMIO register accesses when invalid pins are supplied. The vulnerability is reachable only when CONFIG_USERSPACE=y and requires the attacker to hold a user-mode grant to a GPIO device.

Affected products

Zephyr Project Zephyr RTOS

Timeline

2026-10-28: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.