zephyrproject zephyr

• CVE-2026-87044 Medium 6.5 Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service 0.2%
• CVE-2026-87043 Medium 4.8 sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready 0.2%
• CVE-2026-87041 High 7.8 Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory 0.1%
• CVE-2026-87040 High 8.3 Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write 0.3%
• CVE-2026-87039 High 7.8 I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers 0.1%
• CVE-2026-87038 High 7.0 Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode <0.1%
• CVE-2026-16511 High 8.8 Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory 0.2%
• CVE-2026-85036 Medium 5.7 Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue 0.2%
• CVE-2026-85035 High 8.8 Use-after-free via dynamically allocated message queue retained by the CAN RX filter 0.2%
• CVE-2026-85034 Medium 6.7 Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers 0.2%
• CVE-2026-85033 Medium 4.6 Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer 0.2%
• CVE-2026-85032 Medium 4.8 Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress 0.2%
• CVE-2026-82962 Medium 6.5 Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet 0.3%
• CVE-2026-82961 High 7.8 Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode 0.1%
• CVE-2026-82390 Low 3.7 Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver 0.2%
• CVE-2026-82389 Medium 6.5 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference 0.2%
• CVE-2026-82388 Medium 5.3 Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host 0.2%
• CVE-2026-19742 Low 3.7 IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key 0.2%
• CVE-2026-81038 High 7.1 Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses 0.1%
• CVE-2026-81039 Medium 4.3 Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity 0.2%
• CVE-2026-79982 High 8.8 Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size 0.2%
• CVE-2026-79981 Medium 6.5 DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing 0.1%
• CVE-2026-79980 Medium 5.6 Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS 0.2%
• CVE-2026-79979 High 7.8 Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames 0.1%
• CVE-2026-79978 Low 3.6 Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path <0.1%
• CVE-2026-79977 High 8.2 WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr 0.2%
• CVE-2026-19741 High 7.5 OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) 0.3%
• CVE-2026-19947 Medium 5.3 Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer 0.1%
• CVE-2026-79976 High 7.1 NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller 0.3%
• CVE-2026-78119 Medium 6.3 Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length 0.1%
• CVE-2026-78118 High 7.0 Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP 0.1%
• CVE-2026-78117 Medium 4.2 Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air 0.2%
• CVE-2026-18748 Low 3.5 Out-of-bounds read in Bluetooth Classic A2DP codec information element handling 0.2%
• CVE-2026-78116 Medium 5.2 Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path 0.2%
• CVE-2026-19676 High 7.8 PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode 0.2%
• CVE-2026-77684 Medium 5.7 Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service 0.3%
• CVE-2026-19595 Medium 6.1 Zephyr RTIO syscall verifier validates output parameters for read instead of write access 0.1%
• CVE-2026-76788 High 8.8 Stack out-of-bounds write in the OSDP Control Panel reply parser 0.2%
• CVE-2026-76787 Medium 5.9 NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum 0.4%
• CVE-2026-75085 Medium 4.2 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver 0.2%
• CVE-2026-75084 Medium 6.8 Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length 0.3%
• CVE-2026-19673 High 7.1 Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header 0.3%
• CVE-2026-75083 Medium 5.9 Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver 0.2%
• CVE-2026-19940 Medium 6.5 Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping 0.2%
• CVE-2026-19939 Medium 6.3 Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption 0.2%
• CVE-2026-19938 Medium 5.9 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails 0.2%
• CVE-2026-19937 Medium 5.7 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses 0.2%
• CVE-2026-19936 Medium 4.8 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference 0.1%
• CVE-2026-19740 Medium 6.5 Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure 0.1%
• CVE-2026-19739 Medium 6.5 Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update 0.1%