https://vulnogram.org/ Most recent CVEs assigned by Zephyr Project (zephyr). https://vulnogram.org/seaview/icons/zephyr.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-77684 https://vulnogram.org/CVE-2026-77684 The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work it… Medium Mon, 19 Oct 2026 22:49:41 GMT https://vulnogram.org/CVE-2026-19595 https://vulnogram.org/CVE-2026-19595 The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters… Medium Mon, 19 Oct 2026 22:49:40 GMT https://vulnogram.org/CVE-2026-76788 https://vulnogram.org/CVE-2026-76788 The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken… High Mon, 19 Oct 2026 20:39:22 GMT https://vulnogram.org/CVE-2026-76787 https://vulnogram.org/CVE-2026-76787 The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehub.c). The decoder treats every descriptor field as optional — json_obj_parse() returns a b… Medium Mon, 19 Oct 2026 20:39:20 GMT https://vulnogram.org/CVE-2026-75085 https://vulnogram.org/CVE-2026-75085 The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without first checking that the radio-reported length could hold an FCS… Medium Wed, 14 Oct 2026 16:46:02 GMT https://vulnogram.org/CVE-2026-75084 https://vulnogram.org/CVE-2026-75084 The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity() (drivers/ieee802154/ieee802154_cc1200.c). That validation only enforced… Medium Wed, 14 Oct 2026 16:46:01 GMT https://vulnogram.org/CVE-2026-19673 https://vulnogram.org/CVE-2026-19673 ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpret… High Wed, 14 Oct 2026 16:45:57 GMT https://vulnogram.org/CVE-2026-75083 https://vulnogram.org/CVE-2026-75083 The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. The interrup… Medium Wed, 14 Oct 2026 16:45:56 GMT https://vulnogram.org/CVE-2026-19940 https://vulnogram.org/CVE-2026-19940 The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag->t… Medium Tue, 13 Oct 2026 16:40:10 GMT https://vulnogram.org/CVE-2026-19939 https://vulnogram.org/CVE-2026-19939 The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session->timeout_work before cle… Medium Tue, 13 Oct 2026 16:39:16 GMT https://vulnogram.org/CVE-2026-19938 https://vulnogram.org/CVE-2026-19938 The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every other error exit implements) the contract that on failure the caller retains ownership of the… Medium Mon, 12 Oct 2026 23:19:55 GMT https://vulnogram.org/CVE-2026-19937 https://vulnogram.org/CVE-2026-19937 The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT message contexts (default 4) threaded onto a free_ctx or busy_ctx list. release_de… Medium Mon, 12 Oct 2026 23:19:54 GMT https://vulnogram.org/CVE-2026-19936 https://vulnogram.org/CVE-2026-19936 The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronization: bt_mesh_… Medium Mon, 12 Oct 2026 23:19:53 GMT https://vulnogram.org/CVE-2026-19740 https://vulnogram.org/CVE-2026-19740 The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notification when the update instant… Medium Sun, 11 Oct 2026 17:15:08 GMT https://vulnogram.org/CVE-2026-19739 https://vulnogram.org/CVE-2026-19739 The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the ho… Medium Sun, 11 Oct 2026 17:15:06 GMT https://vulnogram.org/CVE-2026-19738 https://vulnogram.org/CVE-2026-19738 The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) so it can later be reused as the host notification — on the peripheral… Medium Sun, 11 Oct 2026 17:15:04 GMT https://vulnogram.org/CVE-2026-19935 https://vulnogram.org/CVE-2026-19935 The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever the channel uses a dynamic PSM (… High Sun, 11 Oct 2026 17:15:03 GMT https://vulnogram.org/CVE-2026-19737 https://vulnogram.org/CVE-2026-19737 i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cfg->rx.data->configured / dev_cfg->tx.data->configured without first checking the stream po… Medium Sun, 11 Oct 2026 17:15:01 GMT https://vulnogram.org/CVE-2026-18418 https://vulnogram.org/CVE-2026-18418 The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as… Low Sun, 11 Oct 2026 17:15:00 GMT https://vulnogram.org/CVE-2026-19736 https://vulnogram.org/CVE-2026-19736 The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT5xx and RT6xx parts the SDK compiles its TRNG_SW_HEALTH_TESTS variant, which alw… High Sun, 11 Oct 2026 17:14:58 GMT https://vulnogram.org/CVE-2026-19735 https://vulnogram.org/CVE-2026-19735 The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a uptime-derived offset, where unique_key is a 128-bit secret filled once by sys_csrand_get(). The return val… Medium Sun, 11 Oct 2026 17:14:56 GMT https://vulnogram.org/CVE-2026-19577 https://vulnogram.org/CVE-2026-19577 net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor… High Sun, 11 Oct 2026 17:14:55 GMT https://vulnogram.org/CVE-2026-19576 https://vulnogram.org/CVE-2026-19576 The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POINTS_MSK (0x0F), yielding a value of 0..15. In gt911_process() that value is used directly… Medium Sun, 11 Oct 2026 17:14:53 GMT https://vulnogram.org/CVE-2026-19669 https://vulnogram.org/CVE-2026-19669 The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-length arrays, union fuel_gauge_prop_val k_vals[len] and fuel_gauge_prop_t k_pro… High Sun, 11 Oct 2026 17:14:51 GMT https://vulnogram.org/CVE-2026-19575 https://vulnogram.org/CVE-2026-19575 The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). k_object_validate() short-circuits its type comparison when the req… High Fri, 09 Oct 2026 07:16:47 GMT https://vulnogram.org/CVE-2026-19569 https://vulnogram.org/CVE-2026-19569 dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size, and for thread stack elements as STACK_ELEMENT_DATA_SIZE(size) (a round-up plus fixed ove… High Fri, 09 Oct 2026 07:16:45 GMT https://vulnogram.org/CVE-2026-19574 https://vulnogram.org/CVE-2026-19574 The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init() (arch/arm64/core/mmu.c). VM_ASID_BITS is 8, so only 255 ASIDs exist; once the counter wrapped, arch_mem_do… High Fri, 09 Oct 2026 07:16:43 GMT https://vulnogram.org/CVE-2026-19571 https://vulnogram.org/CVE-2026-19571 The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data->in_msg and only afterwards chec… Medium Fri, 09 Oct 2026 07:16:40 GMT https://vulnogram.org/CVE-2026-19570 https://vulnogram.org/CVE-2026-19570 The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds chec… High Fri, 09 Oct 2026 07:16:38 GMT https://vulnogram.org/CVE-2026-15894 https://vulnogram.org/CVE-2026-15894 The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In sol_pdu_decrypt(), out is allocated as… High Wed, 07 Oct 2026 08:55:25 GMT https://vulnogram.org/CVE-2026-19186 https://vulnogram.org/CVE-2026-19186 ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without first checking that the received frame is at least ll_hdr_len + authtag_len bytes long. All… High Wed, 07 Oct 2026 08:55:22 GMT https://vulnogram.org/CVE-2026-19185 https://vulnogram.org/CVE-2026-19185 The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the per-target data buffers those array elements… High Mon, 05 Oct 2026 08:06:29 GMT https://vulnogram.org/CVE-2026-19184 https://vulnogram.org/CVE-2026-19184 The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-… High Mon, 05 Oct 2026 08:06:22 GMT https://vulnogram.org/CVE-2026-17053 https://vulnogram.org/CVE-2026-17053 The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smbus/smbus_handlers.c validated only the dev argument with K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS) and forwarded… Medium Thu, 01 Oct 2026 15:08:52 GMT https://vulnogram.org/CVE-2026-18747 https://vulnogram.org/CVE-2026-18747 The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rx_ctxt->nb->len -= 2U; in mcumgr_serial_process_frag() (subsys/mgmt/mcumgr/trans… Medium Mon, 28 Sep 2026 23:25:26 GMT https://vulnogram.org/CVE-2026-18746 https://vulnogram.org/CVE-2026-18746 parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called init_block_ctx() and then immediately stored the peer-selected block… Medium Mon, 28 Sep 2026 23:25:24 GMT https://vulnogram.org/CVE-2026-18417 https://vulnogram.org/CVE-2026-18417 The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTER(-status) in zsock_accepted_cb(), zsock_received_cb(), zsock_connected_cb() and… Medium Mon, 28 Sep 2026 23:25:23 GMT https://vulnogram.org/CVE-2026-18416 https://vulnogram.org/CVE-2026-18416 The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its… Low Mon, 28 Sep 2026 20:00:02 GMT https://vulnogram.org/CVE-2026-18415 https://vulnogram.org/CVE-2026-18415 ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized IEEE802154_MTU). In builds with CONFIG_NET_L2_IEEE802154_FRAGMENT enabled (the default whenev… Medium Mon, 28 Sep 2026 20:00:01 GMT https://vulnogram.org/CVE-2026-18414 https://vulnogram.org/CVE-2026-18414 The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written bey… High Mon, 28 Sep 2026 20:00:00 GMT https://vulnogram.org/CVE-2026-18413 https://vulnogram.org/CVE-2026-18413 The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written bey… High Mon, 28 Sep 2026 19:59:58 GMT https://vulnogram.org/CVE-2026-16513 https://vulnogram.org/CVE-2026-16513 The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop ite… High Mon, 28 Sep 2026 19:59:57 GMT https://vulnogram.org/CVE-2026-17054 https://vulnogram.org/CVE-2026-17054 The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For control frames it took the 16-bit TLV field data_length straight off the wire and passed it to… Medium Mon, 21 Sep 2026 21:16:05 GMT https://vulnogram.org/CVE-2026-15890 https://vulnogram.org/CVE-2026-15890 The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/transform/aead_get.c, stores its nonce counter in unsynchronized function-local stat… Medium Mon, 21 Sep 2026 21:16:04 GMT https://vulnogram.org/CVE-2026-17052 https://vulnogram.org/CVE-2026-17052 The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the d… High Mon, 21 Sep 2026 18:35:30 GMT https://vulnogram.org/CVE-2026-17051 https://vulnogram.org/CVE-2026-17051 The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-written doorbell register, extracted the payload length with IPC_HEADER_GET_LENGTH(), and pass… Medium Mon, 21 Sep 2026 16:41:24 GMT https://vulnogram.org/CVE-2026-17050 https://vulnogram.org/CVE-2026-17050 The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-leng… Medium Mon, 21 Sep 2026 16:41:23 GMT https://vulnogram.org/CVE-2026-16515 https://vulnogram.org/CVE-2026-16515 net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with an ICMPv6 error). It did not check whether the triggering packet's source address identifie… Medium Fri, 18 Sep 2026 14:30:13 GMT https://vulnogram.org/CVE-2026-16514 https://vulnogram.org/CVE-2026-16514 gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlle… Medium Fri, 18 Sep 2026 14:30:11 GMT https://vulnogram.org/CVE-2026-16512 https://vulnogram.org/CVE-2026-16512 gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first checking that the received frame carries at least sizeof(struct gptp_hdr) (34) bytes of payloa… Low Fri, 18 Sep 2026 14:30:10 GMT