CVE-2026-19947: auth in zephyrproject zephyr

The vulnerability in Zephyr's devmux driver arises because the user-mode verifiers for devmux_select_get() and devmux_select_set() system calls do not perform kernel-object validation, allowing unprivileged user-mode threads to manipulate the multiplexer device selection without proper authorization. This is due to devmux devices being registered without a driver API pointer, causing them to lack kernel object tracking and permission enforcement. The impact is an authorization bypass limited to changing the downstream device selection, which can affect console and shell output routing. The kernel implementation bounds-checks device pointers and selection indices, so no memory safety issues exist. The vulnerability requires CONFIG_USERSPACE=y and the experimental CONFIG_DEVMUX=y configuration. The fix involves attaching a proper driver API to devmux devices and adding kernel object access checks in the user-mode verifiers.

An unprivileged user-mode thread can bypass the userspace object-permission model to read and change the downstream device selection of the devmux multiplexer. This can suppress or redirect console, log, and shell output to devices accessible by the attacker. The impact is confined to the fixed set of downstream devices defined in the devicetree and does not allow arbitrary memory access or out-of-bounds operations.

A fix is available that properly registers devmux devices as kernel objects with a driver API and adds kernel object access checks in the user-mode verifiers for devmux system calls. Users should upgrade to Zephyr version 4.5.0 or later where this vulnerability is addressed. No additional mitigation is required if the fix is applied.