CVE-2026-82962 | Medium | 6.5 | 2026-10-28 | ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of the packet's first fra… |
CVE-2026-82961 | High | 7.8 | 2026-10-28 | The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(), z_vrfy… |
CVE-2026-82390 | Low | 3.7 | 2026-10-26 | The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX (def… |
CVE-2026-82389 | Medium | 6.5 | 2026-10-26 | In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the pe… |
CVE-2026-82388 | Medium | 5.3 | 2026-10-26 | bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP disc… |
CVE-2026-81039 | Medium | 4.3 | 2026-10-26 | The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it starts, in le_adv_… |
CVE-2026-81038 | High | 7.1 | 2026-10-26 | The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp… |
CVE-2026-19742 | Low | 3.7 | 2026-10-26 | The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981… |
CVE-2026-79982 | High | 8.8 | 2026-10-23 | The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB… |
CVE-2026-79981 | Medium | 6.5 | 2026-10-23 | The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_loc… |
CVE-2026-79980 | Medium | 5.6 | 2026-10-23 | The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transact… |
CVE-2026-79979 | High | 7.8 | 2026-10-23 | The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an… |
CVE-2026-79978 | Low | 3.6 | 2026-10-23 | The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will… |
CVE-2026-79977 | High | 8.2 | 2026-10-23 | The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when… |
CVE-2026-19741 | High | 7.5 | 2026-10-23 | Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/open… |
CVE-2026-79976 | High | 7.1 | 2026-10-21 | The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a… |
CVE-2026-78119 | Medium | 6.3 | 2026-10-21 | The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length field directl… |
CVE-2026-78118 | High | 7.0 | 2026-10-21 | The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without… |
CVE-2026-78117 | Medium | 4.2 | 2026-10-21 | The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, st… |
CVE-2026-78116 | Medium | 5.2 | 2026-10-21 | The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers… |
CVE-2026-19947 | Medium | 5.3 | 2026-10-21 | The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When CONFIG_USERSPA… |
CVE-2026-19676 | High | 7.8 | 2026-10-21 | The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission a… |
CVE-2026-18748 | Low | 3.5 | 2026-10-21 | The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array… |
CVE-2026-77684 | Medium | 5.7 | 2026-10-19 | The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf-… |
CVE-2026-19595 | Medium | 6.1 | 2026-10-19 | The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with… |
CVE-2026-76788 | High | 8.8 | 2026-10-19 | The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated stru… |
CVE-2026-76787 | Medium | 5.9 | 2026-10-19 | The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updateh… |
CVE-2026-75085 | Medium | 4.2 | 2026-10-14 | The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IE… |
CVE-2026-75084 | Medium | 6.8 | 2026-10-14 | The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verif… |
CVE-2026-75083 | Medium | 5.9 | 2026-10-14 | The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z… |
CVE-2026-19673 | High | 7.1 | 2026-10-14 | ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When t… |
CVE-2026-19940 | Medium | 6.5 | 2026-10-13 | The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static… |
CVE-2026-19939 | Medium | 6.3 | 2026-10-13 | The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every respons… |
CVE-2026-19938 | Medium | 5.9 | 2026-10-13 | The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every ot… |
CVE-2026-19937 | Medium | 5.7 | 2026-10-13 | The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_M… |
CVE-2026-19936 | Medium | 4.8 | 2026-10-13 | The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks)… |
CVE-2026-19935 | High | 7.5 | 2026-10-11 | The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel obje… |
CVE-2026-19740 | Medium | 6.5 | 2026-10-11 | The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_… |
CVE-2026-19739 | Medium | 6.5 | 2026-10-11 | The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update… |
CVE-2026-19738 | Medium | 6.5 | 2026-10-11 | The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked N… |
CVE-2026-19737 | Medium | 5.5 | 2026-10-11 | i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_c… |
CVE-2026-19736 | High | 7.8 | 2026-10-11 | The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData()… |
CVE-2026-19735 | Medium | 4.8 | 2026-10-11 | The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a uptime-derived o… |
CVE-2026-19669 | High | 7.8 | 2026-10-11 | The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared tw… |
CVE-2026-19577 | High | 7.1 | 2026-10-11 | net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whethe… |
CVE-2026-19576 | Medium | 6.8 | 2026-10-11 | The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_PO… |
CVE-2026-18418 | Low | 3.4 | 2026-10-11 | The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s con… |
CVE-2026-19575 | High | 7.8 | 2026-10-09 | The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with K_SYSCALL_OB… |
CVE-2026-19574 | High | 7.0 | 2026-10-09 | The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init() (arch/arm64/cor… |
CVE-2026-19571 | Medium | 6.7 | 2026-10-09 | The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request header from th… |
CVE-2026-19570 | High | 8.8 | 2026-10-09 | The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the st… |
CVE-2026-19569 | High | 8.8 | 2026-10-09 | dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size… |
CVE-2026-19186 | High | 8.1 | 2026-10-07 | ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without… |
CVE-2026-15894 | High | 8.8 | 2026-10-07 | The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte… |
CVE-2026-19185 | High | 7.8 | 2026-10-05 | The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targe… |
CVE-2026-19184 | High | 8.4 | 2026-10-05 | The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of… |
CVE-2026-17053 | Medium | 4.4 | 2026-10-01 | The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smbus/smbus_handlers.c… |
CVE-2026-18747 | Medium | 6.8 | 2026-09-29 | The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing… |
CVE-2026-18746 | Medium | 5.9 | 2026-09-29 | parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of… |
CVE-2026-18417 | Medium | 6.5 | 2026-09-29 | The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = IN… |
CVE-2026-18416 | Low | 3.7 | 2026-09-28 | The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Que… |
CVE-2026-18415 | Medium | 6.3 | 2026-09-28 | ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized IE… |
CVE-2026-18414 | High | 7.8 | 2026-09-28 | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/z… |
CVE-2026-18413 | High | 7.8 | 2026-09-28 | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/z… |
CVE-2026-16513 | High | 7.8 | 2026-09-28 | The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO obje… |
CVE-2026-17054 | Medium | 5.3 | 2026-09-21 | The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For cont… |
CVE-2026-15890 | Medium | 5.3 | 2026-09-21 | The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/s… |
CVE-2026-17052 | High | 7.8 | 2026-09-21 | The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port devi… |
CVE-2026-17051 | Medium | 6.0 | 2026-09-21 | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-wri… |
CVE-2026-17050 | Medium | 5.7 | 2026-09-21 | The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_c… |
CVE-2026-16515 | Medium | 4.7 | 2026-09-18 | net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with… |
CVE-2026-16514 | Medium | 4.3 | 2026-09-18 | gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock… |
CVE-2026-16512 | Low | 3.1 | 2026-09-18 | gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first che… |
CVE-2026-14986 | Medium | 6.8 | 2026-09-14 | The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied wr… |
CVE-2026-16148 | Medium | 4.6 | 2026-09-14 | The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) in… |
CVE-2026-16147 | Medium | 6.8 | 2026-09-14 | The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_ou… |
CVE-2026-15924 | Medium | 5.9 | 2026-09-14 | Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared b… |
CVE-2026-15893 | Medium | 6.5 | 2026-09-14 | net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32… |
CVE-2026-15923 | Medium | 4.6 | 2026-09-14 | The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, fun… |
CVE-2026-15892 | Medium | 5.3 | 2026-09-13 | The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mg… |
CVE-2026-15891 | High | 7.5 | 2026-09-13 | The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invo… |
CVE-2026-15461 | Medium | 5.3 | 2026-09-10 | The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match… |
CVE-2026-15460 | Medium | 5.4 | 2026-09-09 | The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on… |
CVE-2026-14697 | Medium | 6.5 | 2026-08-31 | net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unr… |
CVE-2026-14696 | Medium | 6.5 | 2026-08-31 | When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each fra… |
CVE-2026-14368 | Medium | 5.4 | 2026-08-31 | The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-termi… |
CVE-2026-14367 | Low | 3.1 | 2026-08-31 | The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a pla… |
CVE-2026-14366 | Medium | 6.4 | 2026-08-31 | The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a network packet it does not own. In the Z… |
CVE-2026-13735 | Low | 3.7 | 2026-08-28 | Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data… |
CVE-2026-13734 | Medium | 6.5 | 2026-08-28 | Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late… |
CVE-2026-13481 | Medium | 5.4 | 2026-08-26 | The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME… |
CVE-2026-13480 | Low | 3.1 | 2026-08-26 | The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command… |
CVE-2026-13479 | Low | 3.1 | 2026-08-26 | The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its comma… |
CVE-2026-13478 | Medium | 5.5 | 2026-08-25 | The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_f… |
CVE-2026-13217 | Medium | 5.9 | 2026-08-25 | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp_process_server_m… |
CVE-2026-13216 | Medium | 6.1 | 2026-08-25 | The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_cap() the device-sup… |
CVE-2026-13215 | Medium | 6.8 | 2026-08-25 | The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. ext2_verify_disk_superbloc… |
CVE-2026-13214 | Critical | 9.8 | 2026-08-25 | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from th… |
CVE-2026-13213 | Medium | 5.3 | 2026-08-24 | The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so secur… |
CVE-2026-13343 | Medium | 5.3 | 2026-08-24 | The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_en… |