Zephyrproject vulnerabilities
219 CVEs and advisories name Zephyrproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-19937Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses
- CVE-2026-19936Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference
- CVE-2026-19740Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
- CVE-2026-19739Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
- CVE-2026-19738Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
- CVE-2026-19935Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown
- CVE-2026-19737NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
- CVE-2026-18418Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
- CVE-2026-19736Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths
- CVE-2026-19735Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
- CVE-2026-19577Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address
- CVE-2026-19576Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count
- CVE-2026-19669Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode
- CVE-2026-19575Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code
- CVE-2026-19569Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap
- CVE-2026-19574ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation
- CVE-2026-19571Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request…
- CVE-2026-19570Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state
- CVE-2026-15894Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement
- CVE-2026-19186Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write
- CVE-2026-19185Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode
- CVE-2026-19184Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch
- CVE-2026-17053SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state
- CVE-2026-18747Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read
- CVE-2026-18746NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted
- CVE-2026-18417Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error
- CVE-2026-18416Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)
- CVE-2026-18415Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames
- CVE-2026-18414Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation
- CVE-2026-18413Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation