zephyr.

Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service

• zephyr
• Denial of service

sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready

• zephyr
• Weak cryptography or TLS

Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory

• zephyr
• Memory corruption

Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write

• zephyr
• Memory corruption

I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers

• zephyr
• Memory corruption

Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode

• zephyr
• Race condition

Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory

• zephyr
• Memory corruption
• Broken access control

Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue

• zephyr
• CWE-666

Use-after-free via dynamically allocated message queue retained by the CAN RX filter

• zephyr
• Memory corruption

Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers

• zephyr
• Memory corruption

Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer

• zephyr
• CWE-459

Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress

• zephyr
• Memory corruption

Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet

• zephyr
• Memory corruption

Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode

• zephyr
• Memory corruption

Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver

• zephyr
• Race condition

Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference

• zephyr
• Memory corruption

Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

• zephyr
• Memory corruption

IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key

• zephyr
• Weak cryptography or TLS

Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses

• zephyr
• Denial of service
• Memory corruption

Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity

• zephyr
• Denial of service

Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size

• zephyr
• Memory corruption

DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

• zephyr
• Weak cryptography or TLS

Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS

• zephyr
• CWE-340

Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames

• zephyr
• Memory corruption

Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path

• zephyr
• Memory corruption

WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

• zephyr
• Authentication bypass
• CWE-346

OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)

• zephyr
• CWE-1392

Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer

• zephyr
• Broken access control

NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

• zephyr
• Memory corruption

Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length

• zephyr
• Memory corruption

Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

• zephyr
• Race condition

Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air

• zephyr
• Race condition

Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

• zephyr
• Memory corruption

Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path

• zephyr
• Memory corruption

PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

• zephyr
• Memory corruption

Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service

• zephyr
• Denial of service

Zephyr RTIO syscall verifier validates output parameters for read instead of write access

• zephyr
• Memory corruption

Stack out-of-bounds write in the OSDP Control Panel reply parser

• zephyr
• Memory corruption

NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum

• zephyr
• Memory corruption

Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver

• zephyr
• Memory corruption

Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length

• zephyr
• Memory corruption

Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header

• zephyr
• Memory corruption

Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver

• zephyr
• Memory corruption

Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping

• zephyr
• Memory corruption

Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption

• zephyr
• Memory corruption

Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

• zephyr
• Memory corruption

Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

• zephyr
• Denial of service

Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference

• zephyr
• Race condition

Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure

• zephyr
• Denial of service
• CWE-459

Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update

• zephyr
• Denial of service
• CWE-459

Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures

• zephyr
• Denial of service

Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

• zephyr
• Memory corruption

NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction

• zephyr
• Memory corruption

Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name

• zephyr
• Memory corruption

Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths

• zephyr
• Memory corruption

Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack

• zephyr
• Weak cryptography or TLS

Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address

• zephyr
• Memory corruption

Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count

• zephyr
• Memory corruption

Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode

• zephyr
• Memory corruption

Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code

• zephyr
• Memory corruption