Skip to contentZephyrproject vulnerabilities
Newest
- zephyrproject zephyrBluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection UpdateCVE-2026-197396.5 Medium
- zephyrproject zephyrRetained RX node leak and reachable assertion in Bluetooth Controller CIS Create proceduresCVE-2026-197386.5 Medium
- zephyrproject zephyrUse-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardownCVE-2026-199357.5 High
- zephyrproject zephyrNULL pointer dereference in the ESP32 I2S driver when triggering an unsupported directionCVE-2026-197375.5 Medium
- zephyrproject zephyrOut-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel nameCVE-2026-184183.4 Low
- zephyrproject zephyrOut-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengthsCVE-2026-197367.8 High
- zephyrproject zephyrPredictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stackCVE-2026-197354.8 Medium
- zephyrproject zephyrOut-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer addressCVE-2026-195777.1 High
- zephyrproject zephyrStack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point countCVE-2026-195766.8 Medium
- zephyrproject zephyrUnbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user modeCVE-2026-196697.8 High
- zephyrproject zephyrType confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel codeCVE-2026-195757.8 High
- zephyrproject zephyrInteger overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heapCVE-2026-195698.8 High
- zephyrproject zephyrARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolationCVE-2026-195747.0 High
- zephyrproject zephyrRace condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request bufferCVE-2026-195716.7 Medium
- zephyrproject zephyrOut-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive stateCVE-2026-195708.8 High
- zephyrproject zephyrBluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisementCVE-2026-158948.8 High
- zephyrproject zephyrInteger underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and writeCVE-2026-191868.1 High
- zephyrproject zephyrUnvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user modeCVE-2026-191857.8 High
- zephyrproject zephyrOut-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatchCVE-2026-191848.4 High
- zephyrproject zephyrSMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback stateCVE-2026-170534.4 Medium
- zephyrproject zephyrInteger underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds readCVE-2026-187476.8 Medium
- zephyrproject zephyrNULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhaustedCVE-2026-187465.9 Medium
- zephyrproject zephyrWild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous errorCVE-2026-184176.5 Medium
- zephyrproject zephyrOut-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)CVE-2026-184163.7 Low
- zephyrproject zephyrOut-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN framesCVE-2026-184156.3 Medium
- zephyrproject zephyrOut-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validationCVE-2026-184147.8 High
- zephyrproject zephyrOut-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validationCVE-2026-184137.8 High
- zephyrproject zephyrMissing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel writeCVE-2026-165137.8 High
- zephyrproject zephyrOut-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassemblyCVE-2026-170545.3 Medium
- zephyrproject zephyrAEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronizationCVE-2026-158905.3 Medium
- zephyrproject zephyrMissing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspaceCVE-2026-170527.8 High
- zephyrproject zephyrOut-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell lengthCVE-2026-170516.0 Medium
- zephyrproject zephyrDouble free of the USB host configuration descriptor when device enumeration failsCVE-2026-170505.7 Medium
- zephyrproject zephyrICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stackCVE-2026-165154.7 Medium
- zephyrproject zephyrOut-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemovedCVE-2026-165144.3 Medium
- zephyrproject zephyrOut-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet framesCVE-2026-165123.1 Low
- zephyrproject zephyrOut-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transactionCVE-2026-149866.8 Medium
- zephyrproject zephyrKernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work itemCVE-2026-161484.6 Medium
- zephyrproject zephyrit82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruptionCVE-2026-161476.8 Medium
- zephyrproject zephyrUse-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr socketsCVE-2026-159245.9 Medium
- zephyrproject zephyrZephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoSCVE-2026-158936.5 Medium
- zephyrproject zephyrInfinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_sizeCVE-2026-159234.6 Medium
- zephyrproject zephyrHeap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of serviceCVE-2026-158925.3 Medium
- zephyrproject zephyrNULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gatewayCVE-2026-158917.5 High
- zephyrproject zephyrType confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS inputCVE-2026-154615.3 Medium
- zephyrproject zephyrMissing channel-state validation in Zephyr Bluetooth Classic L2CAP receive pathCVE-2026-154605.4 Medium
- zephyrproject zephyrIPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of serviceCVE-2026-146976.5 Medium
- zephyrproject zephyrEthernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustionCVE-2026-146966.5 Medium
- zephyrproject zephyrOff-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parserCVE-2026-143685.4 Medium
- zephyrproject zephyrI3C IBI work-node free-list data race between ISR and workqueue threadCVE-2026-143673.1 Low
- Show moreLoading…