Browse CVEs

MEDIUM 6.5 CVE-2026-11368 The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_dat… Zephyr 4.5.0+ Fix from $1,6002026-08-04 HIGH 7.5 CVE-2026-10849 The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in res… Zephyr 4.5.0+ Fix from $1,9502026-08-03 HIGH 8.6 CVE-2026-10848 The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helpe… Zephyr 4.5.0+ Fix from $1,9502026-08-02 MEDIUM 6.5 CVE-2026-10774 Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys… Zephyr 4.5.0+ Fix from $1,6002026-08-02 MEDIUM 6.5 CVE-2026-2411 Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to … Zephyr 4.5.0+ Fix from $1,6002026-08-01 MEDIUM 5.4 CVE-2026-10773 The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faul… Zephyr 4.5.0+ Fix from $1,6002026-08-01 HIGH 7.5 CVE-2026-10686 Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_route_packet… Zephyr 4.5.0+ Fix from $1,9502026-07-31 HIGH 7.6 CVE-2026-10685 The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->su… Zephyr 4.5.0+ Fix from $1,9502026-07-31 HIGH 7.8 CVE-2026-10682 The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the … Zephyr 4.5.0+ Fix from $1,9502026-07-27 HIGH 7.0 CVE-2026-10681 In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index from the … Zephyr 4.5.0+ Fix from $1,9502026-07-25 HIGH 8.1 CVE-2026-10678 The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byt… Zephyr after 4.4.1 Fix from $1,9502026-07-21 HIGH 7.6 CVE-2026-10680 The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the m… Zephyr 4.3.1+ Fix from $1,9502026-07-21 MEDIUM 5.5 CVE-2026-10679 The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating… Zephyr after 4.4.1 Fix from $1,6002026-07-21 MEDIUM 6.5 CVE-2026-10677 The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_… Zephyr after 4.4.1 Fix from $1,6002026-07-21 MEDIUM 6.5 CVE-2026-10675 In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdo… Zephyr after 4.4.1 Fix from $1,6002026-07-21 MEDIUM 5.5 CVE-2026-10674 The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the st… Zephyr after 4.4.1 Fix from $1,6002026-07-21 HIGH 8.8 CVE-2026-10673 The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (… Zephyr Mitigation only Fix from $1,9502026-07-15 CRITICAL 9.1 CVE-2026-10672 subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PA… Zephyr Mitigation only Fix from $2,3002026-07-14 HIGH 7.8 CVE-2026-10669 On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verif… Zephyr 4.5.0+ Fix from $1,9502026-07-14 HIGH 7.1 CVE-2026-10671 In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the… Zephyr 4.5.0+ Fix from $1,9502026-07-14 MEDIUM 5.5 CVE-2026-10670 The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_fi… Zephyr 4.5.0+ Fix from $1,6002026-07-14 CRITICAL 9.8 CVE-2026-10666 parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed … Zephyr after 4.4.1 Fix from $2,3002026-07-12 HIGH 7.8 CVE-2026-10667 Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dyna… Zephyr after 4.4.1 Fix from $1,9502026-07-12 HIGH 7.4 CVE-2026-10665 In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload int… Zephyr Patch available Fix from $1,9502026-07-12 MEDIUM 5.0 CVE-2026-10664 The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Targ… Zephyr 4.5.0+ Fix from $1,6002026-07-12 MEDIUM 6.1 CVE-2026-10663 In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device s… Zephyr 4.5.0+ Fix from $1,6002026-07-12 MEDIUM 5.3 CVE-2026-10657 Zephyr's DNS resolver detects mDNS (.local) queries in dns_resolve_name_internal() (subsys/net/lib/dns/resolve.c) with memcmp(strrchr(query, '.'), ".… Zephyr after 4.4.0 Fix from $1,6002026-07-05 HIGH 8.1 CVE-2026-9263 The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO P… Zephyr after 4.4.1 Fix from $1,9502026-06-30 HIGH 8.1 CVE-2026-10653 The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count a… Zephyr after 4.4.1 Fix from $1,9502026-06-30 HIGH 7.4 CVE-2026-10652 Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in dns_unpack_answer(), which validated only the fixed RR heade… Zephyr after 4.4.1 Fix from $1,9502026-06-30