zephyr

Latest CVEs · RSS

• CVE-2026-75085 2026-10-14 · CVSS 4.2
  The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEE
• CVE-2026-75084 2026-10-14 · CVSS 6.8
  The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify
• CVE-2026-19673 2026-10-14 · CVSS 7.1
  ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When th
• CVE-2026-75083 2026-10-14 · CVSS 5.9
  The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_
• CVE-2026-19940 2026-10-13 · CVSS 6.5
  The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static p
• CVE-2026-19939 2026-10-13 · CVSS 6.3
  The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every response
• CVE-2026-19938 2026-10-12 · CVSS 5.9
  The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every oth
• CVE-2026-19937 2026-10-12 · CVSS 5.7
  The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_MS
• CVE-2026-19936 2026-10-12 · CVSS 4.8
  The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks)
• CVE-2026-19740 2026-10-11 · CVSS 6.5
  The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_U
• CVE-2026-19739 2026-10-11 · CVSS 6.5
  The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update
• CVE-2026-19738 2026-10-11 · CVSS 6.5
  The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NO
• CVE-2026-19935 2026-10-11 · CVSS 7.5
  The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel objec
• CVE-2026-19737 2026-10-11 · CVSS 5.5
  i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cf
• CVE-2026-18418 2026-10-11 · CVSS 3.4
  The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conv
• CVE-2026-19736 2026-10-11 · CVSS 7.8
  The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData().
• CVE-2026-19735 2026-10-11 · CVSS 4.8
  The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a uptime-derived of
• CVE-2026-19577 2026-10-11 · CVSS 7.1
  net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whether
• CVE-2026-19576 2026-10-11 · CVSS 6.8
  The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POI
• CVE-2026-19669 2026-10-11 · CVSS 7.8
  The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two
• CVE-2026-19575 2026-10-09 · CVSS 7.8
  The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with K_SYSCALL_OBJ
• CVE-2026-19569 2026-10-09 · CVSS 8.8
  dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size,
• CVE-2026-19574 2026-10-09 · CVSS 7.0
  The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init() (arch/arm64/core
• CVE-2026-19571 2026-10-09 · CVSS 6.7
  The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request header from the
• CVE-2026-19570 2026-10-09 · CVSS 8.8
  The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the sta