Zephyrproject vulnerabilities
219 CVEs and advisories name Zephyrproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-82388Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host
- CVE-2026-19742IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key
- CVE-2026-81038Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses
- CVE-2026-81039Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity
- CVE-2026-79982Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet…
- CVE-2026-79981DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing
- CVE-2026-79980Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS
- CVE-2026-79979Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames
- CVE-2026-79978Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
- CVE-2026-79977WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr
- CVE-2026-19741OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)
- CVE-2026-19947Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer
- CVE-2026-79976NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller
- CVE-2026-78119Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length
- CVE-2026-78118Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP
- CVE-2026-78117Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air
- CVE-2026-18748Out-of-bounds read in Bluetooth Classic A2DP codec information element handling
- CVE-2026-78116Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path
- CVE-2026-19676PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode
- CVE-2026-77684Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service
- CVE-2026-19595Zephyr RTIO syscall verifier validates output parameters for read instead of write access
- CVE-2026-76788Stack out-of-bounds write in the OSDP Control Panel reply parser
- CVE-2026-76787NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum
- CVE-2026-75085Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver
- CVE-2026-75084Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length
- CVE-2026-19673Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header
- CVE-2026-75083Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver
- CVE-2026-19940Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping
- CVE-2026-19939Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption
- CVE-2026-19938Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails