zephyrproject zephyr

• CVE-2026-19738 Medium 6.5 Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures 0.1%
• CVE-2026-19935 High 7.5 Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown 0.2%
• CVE-2026-19737 Medium 5.5 NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction 0.1%
• CVE-2026-18418 Low 3.4 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name 0.1%
• CVE-2026-19736 High 7.8 Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths 0.1%
• CVE-2026-19735 Medium 4.8 Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack 0.2%
• CVE-2026-19577 High 7.1 Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address 0.2%
• CVE-2026-19576 Medium 6.8 Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count 0.2%
• CVE-2026-19669 High 7.8 Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode 0.2%
• CVE-2026-19575 High 7.8 Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code 0.1%
• CVE-2026-19569 High 8.8 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap 0.2%
• CVE-2026-19574 High 7.0 ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation <0.1%
• CVE-2026-19571 Medium 6.7 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer <0.1%
• CVE-2026-19570 High 8.8 Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state 0.3%
• CVE-2026-15894 High 8.8 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement 0.3%
• CVE-2026-19186 High 8.1 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write 0.2%
• CVE-2026-19185 High 7.8 Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode 0.2%
• CVE-2026-19184 High 8.4 Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch 0.1%
• CVE-2026-17053 Medium 4.4 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state <0.1%
• CVE-2026-18747 Medium 6.8 Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read 0.1%
• CVE-2026-18746 Medium 5.9 NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted 0.2%
• CVE-2026-18417 Medium 6.5 Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error 0.2%
• CVE-2026-18416 Low 3.7 Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri) 0.2%
• CVE-2026-18415 Medium 6.3 Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames <0.1%
• CVE-2026-18414 High 7.8 Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation 0.1%
• CVE-2026-18413 High 7.8 Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation 0.1%
• CVE-2026-16513 High 7.8 Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write 0.2%
• CVE-2026-17054 Medium 5.3 Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly 0.2%
• CVE-2026-15890 Medium 5.3 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization <0.1%
• CVE-2026-17052 High 7.8 Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace 0.2%
• CVE-2026-17051 Medium 6.0 Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length 0.2%
• CVE-2026-17050 Medium 5.7 Double free of the USB host configuration descriptor when device enumeration fails 0.2%
• CVE-2026-16515 Medium 4.7 ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack 0.2%
• CVE-2026-16514 Medium 4.3 Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved 0.3%
• CVE-2026-16512 Low 3.1 Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames 0.2%
• CVE-2026-14986 Medium 6.8 Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction 0.3%
• CVE-2026-16148 Medium 4.6 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item 0.2%
• CVE-2026-16147 Medium 6.8 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption 0.3%
• CVE-2026-15924 Medium 5.9 Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets 0.4%
• CVE-2026-15893 Medium 6.5 Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS 0.3%
• CVE-2026-15923 Medium 4.6 Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size 0.2%
• CVE-2026-15892 Medium 5.3 Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service 0.5%
• CVE-2026-15891 High 7.5 NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway 0.6%
• CVE-2026-15461 Medium 5.3 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input 0.2%
• CVE-2026-15460 Medium 5.4 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path 0.2%
• CVE-2026-14697 Medium 6.5 IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service 0.3%
• CVE-2026-14696 Medium 6.5 Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion 0.3%
• CVE-2026-14368 Medium 5.4 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser 0.3%
• CVE-2026-14367 Low 3.1 I3C IBI work-node free-list data race between ISR and workqueue thread 0.1%
• CVE-2026-14366 Medium 6.4 SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt 0.2%