zephyr.

Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap

• zephyr
• Memory corruption

ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation

• zephyr
• Broken access control

Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer

• zephyr
• Race condition

Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

• zephyr
• Memory corruption

Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

• zephyr
• Memory corruption

Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

• zephyr
• Memory corruption

Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode

• zephyr
• Memory corruption

Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch

• zephyr
• Memory corruption

SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

• zephyr
• Broken access control

Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read

• zephyr
• Memory corruption

NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted

• zephyr
• Memory corruption

Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error

• zephyr
• Memory corruption

Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)

• zephyr
• Memory corruption

Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames

• zephyr
• Memory corruption

Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation

• zephyr
• Memory corruption

Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation

• zephyr
• Memory corruption

Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write

• zephyr
• Memory corruption

Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly

• zephyr
• Memory corruption

AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization

• zephyr
• Race condition
• CWE-323

Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace

• zephyr
• Memory corruption

Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length

• zephyr
• Memory corruption

Double free of the USB host configuration descriptor when device enumeration fails

• zephyr
• Memory corruption

ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack

• zephyr
• CWE-406

Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved

• zephyr
• Memory corruption

Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames

• zephyr
• Memory corruption

Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction

• zephyr
• Memory corruption

Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

• zephyr
• CWE-666

it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

• zephyr
• Memory corruption

Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets

• zephyr
• Memory corruption

Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS

• zephyr
• Denial of service

Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size

• zephyr
• Denial of service

Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service

• zephyr
• Denial of service

NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway

• zephyr
• Memory corruption

Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

• zephyr
• Memory corruption

Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path

• zephyr
• CWE-666

IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service

• zephyr
• Denial of service

Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion

• zephyr
• Denial of service

Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

• zephyr
• Memory corruption
• CWE-193

I3C IBI work-node free-list data race between ISR and workqueue thread

• zephyr
• Race condition

SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt

• zephyr
• Memory corruption

WireGuard keepalive transport-data messages accepted without Poly1305 authentication

• zephyr
• Authentication bypass

Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack

• zephyr
• Authentication bypass

Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

• zephyr
• Memory corruption

Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler

• zephyr
• Memory corruption
• CWE-20

Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler

• zephyr
• Memory corruption

Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count

• zephyr
• Memory corruption

NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi

• zephyr
• Memory corruption

Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length

• zephyr
• Memory corruption

Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image

• zephyr
• Memory corruption

Stack buffer overflow in OCPP GetConfiguration key parsing

• zephyr
• Memory corruption

Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

• zephyr
• Memory corruption

Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

• zephyr
• CWE-129

Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder

• zephyr
• Information disclosure

TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

• zephyr
• Race condition

Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion

• zephyr
• Denial of service

Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

• zephyr
• Memory corruption

Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields

• zephyr
• Memory corruption

Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement

• zephyr
• Memory corruption

Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type

• zephyr
• Memory corruption

Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel

• zephyr
• Broken access control