Zephyr (Zephyrproject) - vulnerabilities (CVEs)

194 CVEs, 60 in the last 30 days, 279 known versions, newest CVE from 2026-10-28. Vendor: Zephyrproject.

CVEs of Zephyr

• CVE-2026-82962 - CVSS 6.5 (medium), 2026-10-28: ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of the packet's first…
• CVE-2026-82961 - CVSS 7.8 (high), 2026-10-28: The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(),…
• CVE-2026-82390 - CVSS 3.7 (low), 2026-10-26: The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX…
• CVE-2026-82389 - CVSS 6.5 (medium), 2026-10-26: In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the…
• CVE-2026-82388 - CVSS 5.3 (medium), 2026-10-26: bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP…
• CVE-2026-19742 - CVSS 3.7 (low), 2026-10-26: The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981…
• CVE-2026-81038 - CVSS 7.1 (high), 2026-10-26: The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send()…
• CVE-2026-81039 - CVSS 4.3 (medium), 2026-10-26: The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it starts, in…
• CVE-2026-79982 - CVSS 8.8 (high), 2026-10-23: The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a…
• CVE-2026-79981 - CVSS 6.5 (medium), 2026-10-23: The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised…
• CVE-2026-79980 - CVSS 5.6 (medium), 2026-10-23: The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a…
• CVE-2026-79979 - CVSS 7.8 (high), 2026-10-23: The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with…
• CVE-2026-79978 - CVSS 3.6 (low), 2026-10-23: The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will…
• CVE-2026-79977 - CVSS 8.2 (high), 2026-10-23: The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(),…
• CVE-2026-19741 - CVSS 7.5 (high), 2026-10-23: Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously…
• CVE-2026-19947 - CVSS 5.3 (medium), 2026-10-21: The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When…
• CVE-2026-79976 - CVSS 7.1 (high), 2026-10-21: The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes…
• CVE-2026-78119 - CVSS 6.3 (medium), 2026-10-21: The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length field…
• CVE-2026-78118 - CVSS 7 (high), 2026-10-21: The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without…
• CVE-2026-78117 - CVSS 4.2 (medium), 2026-10-21: The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable,…
• CVE-2026-18748 - CVSS 3.5 (low), 2026-10-21: The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array.…
• CVE-2026-78116 - CVSS 5.2 (medium), 2026-10-21: The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler()…
• CVE-2026-19676 - CVSS 7.8 (high), 2026-10-21: The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission…
• CVE-2026-77684 - CVSS 5.7 (medium), 2026-10-19: The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on…
• CVE-2026-19595 - CVSS 6.1 (medium), 2026-10-19: The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len,…
• CVE-2026-76788 - CVSS 8.8 (high), 2026-10-19: The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated…
• CVE-2026-76787 - CVSS 5.9 (medium), 2026-10-19: The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe()…
• CVE-2026-75085 - CVSS 4.2 (medium), 2026-10-14: The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length -…
• CVE-2026-75084 - CVSS 6.8 (medium), 2026-10-14: The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in…
• CVE-2026-19673 - CVSS 7.1 (high), 2026-10-14: ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When…
• CVE-2026-75083 - CVSS 5.9 (medium), 2026-10-14: The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len -…
• CVE-2026-19940 - CVSS 6.5 (medium), 2026-10-13: The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static…
• CVE-2026-19939 - CVSS 6.3 (medium), 2026-10-13: The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every…
• CVE-2026-19938 - CVSS 5.9 (medium), 2026-10-12: The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every…
• CVE-2026-19937 - CVSS 5.7 (medium), 2026-10-12: The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of…
• CVE-2026-19936 - CVSS 4.8 (medium), 2026-10-12: The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx,…
• CVE-2026-19740 - CVSS 6.5 (medium), 2026-10-11: The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted…
• CVE-2026-19739 - CVSS 6.5 (medium), 2026-10-11: The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection…
• CVE-2026-19738 - CVSS 6.5 (medium), 2026-10-11: The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked…
• CVE-2026-19935 - CVSS 7.5 (high), 2026-10-11: The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel…
• CVE-2026-19737 - CVSS 5.5 (medium), 2026-10-11: i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read…
• CVE-2026-18418 - CVSS 3.4 (low), 2026-10-11: The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s…
• CVE-2026-19736 - CVSS 7.8 (high), 2026-10-11: The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine…
• CVE-2026-19735 - CVSS 4.8 (medium), 2026-10-11: The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a uptime-derived…
• CVE-2026-19577 - CVSS 7.1 (high), 2026-10-11: net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking…
• CVE-2026-19576 - CVSS 6.8 (medium), 2026-10-11: The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with…
• CVE-2026-19669 - CVSS 7.8 (high), 2026-10-11: The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared…
• CVE-2026-19575 - CVSS 7.8 (high), 2026-10-09: The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with…
• CVE-2026-19569 - CVSS 8.8 (high), 2026-10-09: dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) +…
• CVE-2026-19574 - CVSS 7 (high), 2026-10-09: The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init()…
• CVE-2026-19571 - CVSS 6.7 (medium), 2026-10-09: The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request header from…
• CVE-2026-19570 - CVSS 8.8 (high), 2026-10-09: The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the…
• CVE-2026-15894 - CVSS 8.8 (high), 2026-10-07: The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed…
• CVE-2026-19186 - CVSS 8.1 (high), 2026-10-07: ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without…
• CVE-2026-19185 - CVSS 7.8 (high), 2026-10-05: The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the…
• CVE-2026-19184 - CVSS 8.4 (high), 2026-10-05: The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number…
• CVE-2026-17053 - CVSS 4.4 (medium), 2026-10-01: The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in…
• CVE-2026-18747 - CVSS 6.8 (medium), 2026-09-28: The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the…
• CVE-2026-18746 - CVSS 5.9 (medium), 2026-09-28: parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block…
• CVE-2026-18417 - CVSS 6.5 (medium), 2026-09-28: The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data =…
• CVE-2026-18416 - CVSS 5.3 (medium), 2026-09-28: The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a…
• CVE-2026-18415 - CVSS 7.1 (high), 2026-09-28: ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized…
• CVE-2026-18414 - CVSS 7.8 (high), 2026-09-28: The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in…
• CVE-2026-18413 - CVSS 7.8 (high), 2026-09-28: The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in…
• CVE-2026-16513 - CVSS 7.8 (high), 2026-09-28: The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO…
• CVE-2026-17054 - CVSS 5.3 (medium), 2026-09-21: The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For…
• CVE-2026-15890 - CVSS 5.3 (medium), 2026-09-21: The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in…
• CVE-2026-17052 - CVSS 7.8 (high), 2026-09-21: The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port…
• CVE-2026-17051 - CVSS 6 (medium), 2026-09-21: The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the…
• CVE-2026-17050 - CVSS 5.7 (medium), 2026-09-21: The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in…
• CVE-2026-16515 - CVSS 4.7 (medium), 2026-09-18: net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with…
• CVE-2026-16514 - CVSS 4.3 (medium), 2026-09-18: gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock…
• CVE-2026-16512 - CVSS 3.1 (low), 2026-09-18: gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first…
• CVE-2026-14986 - CVSS 6.8 (medium), 2026-09-14: The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied…
• CVE-2026-16148 - CVSS 4.6 (medium), 2026-09-14: The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler)…
• CVE-2026-16147 - CVSS 6.8 (medium), 2026-09-14: The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In…
• CVE-2026-15924 - CVSS 5.9 (medium), 2026-09-14: Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared…
• CVE-2026-15893 - CVSS 6.5 (medium), 2026-09-14: net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable +…
• CVE-2026-15923 - CVSS 4.6 (medium), 2026-09-14: The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining,…
• CVE-2026-15892 - CVSS 5.3 (medium), 2026-09-13: The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in…
• CVE-2026-15891 - CVSS 7.5 (high), 2026-09-13: The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It…
• CVE-2026-15461 - CVSS 5.3 (medium), 2026-09-10: The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct…
• CVE-2026-15460 - CVSS 5.4 (medium), 2026-09-09: The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on…
• CVE-2026-14697 - CVSS 6.5 (medium), 2026-08-31: net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an…
• CVE-2026-14696 - CVSS 6.5 (medium), 2026-08-31: When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each…
• CVE-2026-14368 - CVSS 5.4 (medium), 2026-08-31: The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and…
• CVE-2026-14367 - CVSS 3.1 (low), 2026-08-31: The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a…
• CVE-2026-14366 - CVSS 6.4 (medium), 2026-08-31: The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a network packet it does not own. In the…
• CVE-2026-13735 - CVSS 3.7 (low), 2026-08-28: Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4…
• CVE-2026-13734 - CVSS 6.5 (medium), 2026-08-28: Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too…
• CVE-2026-13481 - CVSS 5.4 (medium), 2026-08-26: The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME…
• CVE-2026-13480 - CVSS 3.1 (low), 2026-08-26: The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink…
• CVE-2026-13479 - CVSS 4.3 (medium), 2026-08-26: The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its…
• CVE-2026-13478 - CVSS 5.5 (medium), 2026-08-25: The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count -…
• CVE-2026-13217 - CVSS 5.9 (medium), 2026-08-25: The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In…
• CVE-2026-13216 - CVSS 6.1 (medium), 2026-08-25: The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_cap() the…
• CVE-2026-13215 - CVSS 6.8 (medium), 2026-08-25: The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem.…
• CVE-2026-13214 - CVSS 9.8 (critical), 2026-08-25: The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from…
• CVE-2026-13213 - CVSS 5.3 (medium), 2026-08-24: The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so…
• CVE-2026-13212 - CVSS 8.8 (high), 2026-08-24: The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr()…