Skip to contentZephyrproject Zephyr vulnerabilities
- zephyrproject zephyrKernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work itemCVE-2026-161484.6 Medium
- zephyrproject zephyrit82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruptionCVE-2026-161476.8 Medium
- zephyrproject zephyrUse-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr socketsCVE-2026-159245.9 Medium
- zephyrproject zephyrZephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoSCVE-2026-158936.5 Medium
- zephyrproject zephyrInfinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_sizeCVE-2026-159234.6 Medium
- zephyrproject zephyrHeap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of serviceCVE-2026-158925.3 Medium
- zephyrproject zephyrNULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gatewayCVE-2026-158917.5 High
- zephyrproject zephyrType confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS inputCVE-2026-154615.3 Medium
- zephyrproject zephyrMissing channel-state validation in Zephyr Bluetooth Classic L2CAP receive pathCVE-2026-154605.4 Medium
- zephyrproject zephyrIPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of serviceCVE-2026-146976.5 Medium
- zephyrproject zephyrEthernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustionCVE-2026-146966.5 Medium
- zephyrproject zephyrOff-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parserCVE-2026-143685.4 Medium
- zephyrproject zephyrI3C IBI work-node free-list data race between ISR and workqueue threadCVE-2026-143673.1 Low
- zephyrproject zephyrSiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pktCVE-2026-143666.4 Medium
- zephyrproject zephyrWireGuard keepalive transport-data messages accepted without Poly1305 authenticationCVE-2026-137353.7 Low
- zephyrproject zephyrZephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijackCVE-2026-137346.5 Medium
- zephyrproject zephyrOut-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTPCVE-2026-134815.4 Medium
- zephyrproject zephyrOut-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handlerCVE-2026-134803.1 Low
- zephyrproject zephyrOut-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handlerCVE-2026-134793.1 Low
- zephyrproject zephyrOut-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_countCVE-2026-134785.5 Medium
- zephyrproject zephyrNULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoiCVE-2026-132175.9 Medium
- zephyrproject zephyrOut-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability lengthCVE-2026-132166.1 Medium
- zephyrproject zephyrZephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem imageCVE-2026-132156.8 Medium
- zephyrproject zephyrStack buffer overflow in OCPP GetConfiguration key parsingCVE-2026-132149.8 Critical
- zephyrproject zephyrBluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_registerCVE-2026-132135.3 Medium
- zephyrproject zephyrZephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor idCVE-2026-132128.8 High
- zephyrproject zephyrUninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responderCVE-2026-133435.3 Medium
- zephyrproject zephyrTOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memoryCVE-2026-97286.4 Medium
- zephyrproject zephyrInfineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustionCVE-2026-129995.3 Medium
- zephyrproject zephyrOut-of-bounds stack write in the settings NVS backend from over-reported nvs_read lengthCVE-2026-126345.3 Medium
- zephyrproject zephyrStack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fieldsCVE-2026-125228.8 High
- zephyrproject zephyrOut-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router AdvertisementCVE-2026-126338.1 High
- zephyrproject zephyrOut-of-bounds read in Zephyr PTP message parsing from unvalidated message typeCVE-2026-126326.5 Medium
- zephyrproject zephyrBroken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernelCVE-2026-126316.5 Medium
- zephyrproject zephyrStack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlersCVE-2026-125206.4 Medium
- zephyrproject zephyrOut-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsingCVE-2026-125195.0 Medium
- zephyrproject zephyrMissing device-pointer validation in flash_copy() syscall allows userspace privilege escalationCVE-2026-97718.8 High
- zephyrproject zephyr6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing modeCVE-2026-126304.3 Medium
- zephyrproject zephyrPL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of serviceCVE-2026-126294.6 Medium
- zephyrproject zephyrUse-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposalCVE-2026-123668.8 High
- zephyrproject zephyrUse-after-free in Zephyr delayable work-queue cancellation under SMP timing raceCVE-2026-123655.8 Medium
- zephyrproject zephyrMissing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of serviceCVE-2026-123648.4 High
- zephyrproject zephyrOut-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0CVE-2026-123634.2 Medium
- zephyrproject zephyrInfinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data lengthCVE-2026-122366.5 Medium
- zephyrproject zephyrOut-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)CVE-2026-122356.3 Medium
- zephyrproject zephyrTOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds writeCVE-2026-122347.8 High
- zephyrproject zephyrUninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contentionCVE-2026-122335.9 Medium
- zephyrproject zephyrOut-of-bounds read via unvalidated stream_id in Intel ALH DAI get_propertiesCVE-2026-122326.1 Medium
- zephyrproject zephyrOut-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the responseCVE-2026-120525.2 Medium
- zephyrproject zephyrNULL pointer dereference in USB DFU device_next download handler (handle_download)CVE-2026-120514.6 Medium
- Show moreLoading…