# CVE-2026-82961: Zephyr GPIO syscall pin validation bypass

Source: https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-82961 · Severity: high · CVSS 7.8 · Published 2026-10-28

Zephyr's GPIO driver interface, used to control electrical pins on embedded systems, failed to validate pin numbers from user-mode applications. A malicious user-mode thread with GPIO access could supply an invalid pin number to trigger out-of-bounds memory writes and reads in kernel space, potentially corrupting kernel data, executing arbitrary code, or crashing the system.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-82961 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82961 being exploited in the wild.

**How severe is CVE-2026-82961?** High severity, with a CVSS score of 7.8, published 28 October 2026.

**Which products and versions are affected?** Zephyr Project Zephyr RTOS.

**Is there a fix for CVE-2026-82961?** Yes: fixed in <UNKNOWN>. Until then: Disable CONFIG_USERSPACE or restrict GPIO device grants to trusted user-mode threads only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82961 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-82961?** Check whether you run Zephyr Project Zephyr RTOS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

Disable CONFIG_USERSPACE or restrict GPIO device grants to trusted user-mode threads only.

## Technical details

The z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config(), and z_vrfy_gpio_pin_interrupt_configure() syscall handlers in drivers/gpio/gpio_handlers.c validated the GPIO device object but not the pin argument, passing caller-supplied pin values directly to driver implementations. GPIO drivers use the pin as both a shift count and array index into fixed-size tables, causing out-of-bounds writes to function pointer callbacks and MMIO register accesses when invalid pins are supplied. The vulnerability is reachable only when CONFIG_USERSPACE=y and requires the attacker to hold a user-mode grant to a GPIO device.

## Affected products

- Zephyr Project Zephyr RTOS

## Timeline

- 2026-10-28: disclosed

## Related threats

- [Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a)
- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random)
- [Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter)
- [Zephyr device multiplexer privilege escalation in devmux](https://junglewise.ai/threats/cve-2026-19947-the-device-multiplexer-pseudo-driver-in-drivers-misc-devmux)