Zephyrproject vulnerabilities
219 CVEs and advisories name Zephyrproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-11894Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths
- CVE-2026-11985Cross-thread FPU register leak on ARM when FPU enabled without register sharing
- CVE-2026-11893Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)
- CVE-2026-11812UpdateHub: race condition on shared context causes out-of-bounds write and DoS
- CVE-2026-11811Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS
- CVE-2026-8718Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS
- CVE-2026-11809UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata
- CVE-2026-11810NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)
- CVE-2026-11743Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write
- CVE-2026-11742Use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock
- CVE-2026-11368Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer
- CVE-2026-10849Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body
- CVE-2026-10848Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)
- CVE-2026-10774PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS
- CVE-2026-10773Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)
- CVE-2026-2411Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values
- CVE-2026-10686Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers
- CVE-2026-10685Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler
- CVE-2026-10684Out-of-bounds read in coredump shell when printing stored-dump target code
- CVE-2026-10683DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)
- CVE-2026-10682Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace
- CVE-2026-10681SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot
- CVE-2026-7007Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image
- CVE-2026-10680Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow
- CVE-2026-10679Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)
- CVE-2026-10678NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller
- CVE-2026-10677Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool
- CVE-2026-10675Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)
- CVE-2026-10674DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled
- CVE-2026-10673Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly