Zephyr RTOS EUVD-2026-107488

Exploitation requires a build with CONFIG_USERSPACE=y AND the experimental CONFIG_DEVMUX=y (which depends on CONFIG_DEVICE_MUTABLE=y) AND a zephyr,devmux devicetree node present. Given those, any user-mode thread can call devmux_select_get()/devmux_select_set() on the multiplexer device pointer without ever having been granted access to it, because the verifiers performed no k_object_access_check() and the devmux device had no struct k_object at all. Limiting factors: the attacker must already be executing as a local user-mode thread on the device (not remote), and impact is confined to switching among the fixed set of downstream devices defined in the devicetree - typically console and shell-uart - so there is no path to memory corruption or arbitrary code execution.

This is a moderate, locally-exploitable authorization flaw (CWE-862) rather than a high-urgency remote threat. The provided CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base 5.3) is internally consistent with the description: exploitation requires an already-running user-mode thread on the device (local vector, low privilege), and the impact is bounded Low across C/I/A because the attacker can only read or change which devicetree-fixed downstream device a multiplexer forwards to - not achieve memory corruption or code execution (the description explicitly confirms no out-of-bounds access or arbitrary pointer dereference). No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence set, so there is no public exploit identified at time of analysis. The strongest mitigating signal is the narrow exposure surface: the defect is only reachable when CONFIG_USERSPACE=y AND the experimental CONFIG_DEVMUX=y (itself depending on CONFIG_DEVICE_MUTABLE) are set alongside a zephyr,devmux devicetree node - a combination unlikely in most fielded Zephyr builds. No key signals conflict; the main data gap is the absence of EPSS/KEV/POC telemetry, which is expected for a freshly-patched, low-severity embedded RTOS issue and should not be read as evidence of active exploitation.

On a Zephyr device built with userspace isolation and the experimental devmux feature, a low-privilege application thread that was never granted access to the multiplexer calls devmux_select_set() with the compile-time-constant device pointer (e.g. DEVICE_DT_GET(DT_NODELABEL(devmux0))). Because the syscall verifier performed no kernel-object or access check, the thread silently re-points the console/shell-uart multiplexer - suppressing log output, flipping the target under another thread, or redirecting shell traffic to a device it can observe. No public exploit code was provided, but the attack requires only normal syscall access and no special tooling.