The kernel object permission check for the devmux pseudo-driver is missing. When user mode is enabled with the experimental devmux subsystem, the verifiers simply forward the requested device pointer to the kernel without validating the caller’s access rights. The kernel does only bounds checking on the selection index, so the flaw is purely an authorization bypass. An attacker can switch the downstream device that the multiplexer forwards to, allowing the suppression or redirection of console, shell or logging output. The flaw does not provide memory corruption or arbitrary code execution; it only permits unauthorized configuration of a fixed set of downstream devices defined in the devicetree.

The vulnerability impacts the Zephyr RTOS kernel when CONFIG_USERSPACE=y and CONFIG_DEVMUX=y (which depends on CONFIG_DEVICE_MUTABLE) are enabled, and a zephyr,devmux device node is defined in the device tree. The affected product is the Zephyr project’s kernel code, specifically the devmux driver located in drivers/misc/devmux/devmux.c.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available and the issue is not listed in CISA KEV. The attack vector is user‑mode threads running within the Zephyr application. Because the flaw does not involve out‑of‑bounds memory access or privilege escalation to the kernel, the exploitation is limited to manipulating device selection for the pre‑identified devmux nodes. An attacker can redirect or suppress console output, alter shell data, or interfere with other threads that use the same multiplexer.