zephyrproject vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-82961 The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller.High 7.8 · Oct 28, 2026
• CVE-2026-81038 The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.High 7.1 · Oct 26, 2026
• CVE-2026-79982 The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB High 8.8 · Oct 23, 2026
• CVE-2026-79979 The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an High 7.8 · Oct 23, 2026
• CVE-2026-79977 The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate.High 8.2 · Oct 23, 2026
• CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/opentHigh 7.5 · Oct 23, 2026
• CVE-2026-79976 The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a High 7.1 · Oct 21, 2026
• CVE-2026-78118 The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without hHigh 7 · Oct 21, 2026
• CVE-2026-19676 The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission anHigh 7.8 · Oct 21, 2026
• CVE-2026-76788 The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated strucHigh 8.8 · Oct 19, 2026
• CVE-2026-19673 ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr.High 7.1 · Oct 14, 2026
• CVE-2026-19935 The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel objecHigh 7.5 · Oct 11, 2026
• CVE-2026-19736 The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData().High 7.8 · Oct 11, 2026
• CVE-2026-19669 The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared twoHigh 7.8 · Oct 11, 2026
• CVE-2026-19577 net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whetherHigh 7.1 · Oct 11, 2026
• CVE-2026-19575 The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with K_SYSCALL_OBJHigh 7.8 · Oct 9, 2026
• CVE-2026-19574 The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init() (arch/arm64/coreHigh 7 · Oct 9, 2026
• CVE-2026-19570 The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the staHigh 8.8 · Oct 9, 2026
• CVE-2026-19569 dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size,High 8.8 · Oct 9, 2026
• CVE-2026-19186 ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without fHigh 8.1 · Oct 7, 2026
• CVE-2026-15894 The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte High 8.8 · Oct 7, 2026
• CVE-2026-19185 The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targetHigh 7.8 · Oct 5, 2026
• CVE-2026-19184 The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of High 8.4 · Oct 5, 2026
• CVE-2026-18414 The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zeHigh 7.8 · Sep 28, 2026
• CVE-2026-18413 The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zeHigh 7.8 · Sep 28, 2026