CVE-2026-75084 is a vulnerability in the Zephyr project's CC1200 sub-GHz IEEE 802.15.4 driver. The driver improperly validates the PHY packet length, allowing an attacker within radio range to send a frame with an invalid length byte exceeding the IEEE 802.15.4 maximum. This leads to a buffer overflow in the network buffer pool, causing corruption and potential crashes. The flaw requires no authentication or user interaction and affects builds with CONFIG_IEEE802154_CC1200 enabled and an attached CC1200 radio.
CVE-2026-19673 is a vulnerability in the Zephyr project affecting Ethernet frame processing when VLAN is enabled on the interface. The issue arises because the ethernet_recv() function improperly validates buffer lengths when handling VLAN-tagged frames, leading to out-of-bounds reads and buffer underflows. This can cause a remote denial of service and potential information disclosure or memory corruption. Only configurations with VLAN enabled and without hardware VLAN tag stripping are affected. The vulnerability has a CVSS score of 7.1 (high severity).
CVE-2026-75083 is an integer overflow vulnerability in the NXP KW41Z IEEE 802.15.4 driver within the Zephyr project. It occurs in the kw41z_rx() function where the payload size is computed incorrectly, leading to an underflow and subsequent buffer overflow in the network buffer pool. This can cause memory corruption and likely crashes due to overwriting adjacent memory. The vulnerability is triggered by unauthenticated frames with a crafted length field sent over the air. The issue affects Zephyr versions from 1.8.0 up to but not including 4.5.0.
CVE-2026-19940 is a use-after-free vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway implementation of Zephyr. It occurs due to improper handling of work items in a static pool during ACL connection teardown and re-creation. This leads to kernel timeout list corruption, causing system faults or hangs and resulting in denial of service. The vulnerability affects Zephyr versions 4.2.0 through 4.4.2 with CONFIG_BT_HFP_AG enabled and the asynchronous get_ongoing_call callback implemented. No code execution or data corruption is possible from this flaw.
CVE-2026-19939 is a medium severity memory-safety vulnerability in the Zephyr project affecting the Bluetooth AVDTP signalling layer. It arises from improper handling of a delayed work item during AVDTP signalling channel disconnect and reconnect events, leading to kernel data structure corruption and potential system-wide crash or hang. The issue requires an encrypted BR/EDR Bluetooth link and the experimental CONFIG_BT_A2DP option enabled. The vulnerability affects Zephyr versions from 3.7.0 through 4.4.2.
CVE-2026-19938 is a use-after-free vulnerability in the Zephyr Bluetooth host ATT transmit path. It occurs when the ATT Signed Write Command fails signing due to missing local CSRK keys, causing a buffer to be freed incorrectly and later reused. This leads to host-side memory corruption, including list corruption, double frees, and out-of-bounds writes, typically resulting in crashes or assertion failures. The vulnerability requires the deprecated CONFIG_BT_SIGNING to be enabled and an application issuing signed writes. It affects Zephyr versions from 2.3.0 up to but not including 4.5.0.
CVE-2026-19937 is a denial of service vulnerability in the Zephyr Bluetooth Mesh Access layer affecting versions 3.6.0 through 4.4.2. It involves a resource leak in the delayable-message context pool when handling segmented messages under certain conditions, causing the device to silently drop replies and become unresponsive until rebooted. There is no memory corruption or data integrity impact.
CVE-2026-19936 is a race condition vulnerability in the Zephyr Bluetooth Mesh Access-layer delayable message queue. It arises from unsynchronized access to shared lists and a delayable work item between two cooperative threads, leading to potential null pointer dereferences and duplicated message transmissions. The vulnerability can cause the system workqueue thread to abort or the node to reset, resulting in loss of availability. It does not allow memory corruption or code execution. A fix is available that serializes list mutations with a spinlock and removes unsafe list operations.
CVE-2026-19740 is a denial-of-service vulnerability in the Zephyr Bluetooth LE Controller's Link Layer Control Procedure (LLCP) implementation. A crafted sequence of Bluetooth LE control PDUs can cause the controller to leak receive nodes or trigger an assertion failure, exhausting the receive pool and rendering Bluetooth inoperable until reboot. The issue affects Zephyr versions from 3.4.0 up to but not including 4.5.0. The vulnerability does not lead to memory corruption or information disclosure, only availability impact.
CVE-2026-19739 is a denial of service vulnerability in the Zephyr Bluetooth Link Layer controller affecting versions from 3.4.0 up to but not including 4.5.0. The flaw involves improper handling of retained RX nodes during Connection Update or Connection Parameter procedures, which can lead to either a fatal controller error or exhaustion of the controller's RX buffer pool. This vulnerability can be triggered remotely by a peer device without requiring pairing, bonding, or encryption, causing persistent denial of service until the device is rebooted. There is no memory corruption or information disclosure associated with this issue.
CVE-2026-19738 is a denial-of-service vulnerability in the Zephyr project's Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation. The flaw causes memory nodes to be orphaned and not released when invalid PDUs are received, leading to resource exhaustion. An attacker within radio range can trigger this without authentication or encryption by sending crafted LL Control PDUs. The impact is limited to availability, causing system resets or stalled flow control requiring a reboot to recover.
CVE-2026-19935 is a use-after-free vulnerability in the Zephyr Bluetooth LE host's handling of L2CAP connection-oriented channel (CoC) data when using dynamic PSMs (0x0080-0x00FF). The issue arises because the channel teardown process does not cancel a queued work item (rx_work) that references the channel, allowing a remote unauthenticated peer to trigger use-after-free by sending a data K-frame followed immediately by an L2CAP Disconnect Request. This can lead to memory corruption or workqueue malfunction. The vulnerability affects Zephyr versions from 2.0.0 through 4.4.2 and has a CVSS 3.1 score of 7.5 (high severity).
CVE-2026-19737 is a memory-safety vulnerability in the Zephyr project's i2s_esp32 driver affecting versions from 4.4.0 up to but not including 4.5.0. The issue arises when the driver dereferences NULL pointers for I2S directions not implemented by the device, leading to a kernel-mode read from address zero. This can be triggered by an unprivileged user-mode thread with access to the I2S device, causing a system-wide denial of service due to a fatal exception. The vulnerability does not allow information disclosure or code execution. A fix has been merged that adds proper pointer checks and returns an error for unsupported directions.
CVE-2026-18418 is a low-severity vulnerability in the Zephyr project affecting the zbus proxy agent IPC backend. It involves improper handling of a non-NUL-terminated channel_name field in inter-domain frames, which can cause out-of-bounds reads during logging. This may lead to limited memory disclosure in logs or a potential fatal fault. The vulnerability requires specific configuration and conditions, including control over a peer domain's firmware and logging at warning level or above.
CVE-2026-19736 is a vulnerability in the NXP MCUX TRNG entropy driver used in Zephyr OS on certain i.MX RT5xx and RT6xx SoCs. The driver passes the requested byte count directly to the vendor SDK's TRNG_GetRandomData() function, which rounds entropy requests up to multiples of 128 bytes and copies data in 32-bit words. Requests for entropy with lengths not divisible by four cause an underflow in the SDK's buffer size check, resulting in up to 127 bytes of memory being overwritten beyond the caller's buffer. This overflow can corrupt kernel memory or adjacent user memory, potentially causing crashes or privilege escalation. The issue affects Zephyr versions from 4.3.0 through 4.4.2 on affected hardware. A patch is available that ensures only word-aligned requests are passed to the SDK, preventing overflow.
CVE-2026-19735 is a medium-severity vulnerability in the Zephyr project's TCP initial sequence number (ISN) generation. Due to improper handling of failures in the cryptographic random source, the unique key used for ISN generation can remain all zeros, making ISNs predictable. This weakens the protection against blind TCP connection spoofing and data injection. The issue affects Zephyr versions from 3.7.0 through 4.4.2. A fix has been implemented to ensure key generation only latches on success and falls back to a less secure random source if necessary.
CVE-2026-19577 is a vulnerability in the Zephyr project affecting the IPv6 neighbor cache handling. It involves an out-of-bounds read when resolving the next-hop link-layer address for IPv6 packets. An unauthenticated attacker on the same link can trigger this by causing unresolved neighbor cache entries and then sending packets to those neighbors. This can lead to a denial of service via device panic if assertions are enabled, or information disclosure of static RAM contents if assertions are disabled.
CVE-2026-19576 is a vulnerability in the Goodix GT9xx input driver of the Zephyr project. The driver reads a touch point count from the controller and uses it unchecked as a loop bound to fill a stack array sized for a maximum of 5 touch points. A malicious or faulty controller can report more points, causing a stack buffer overflow with attacker-controlled data. This can lead to kernel privilege code execution, out-of-bounds reads, and system crashes. The vulnerability requires physical or local hardware access to the I2C touch controller. A fix is available that clamps the reported touch count to the configured maximum before indexing the array.
CVE-2026-19669 is a high-severity memory safety vulnerability in the Zephyr RTOS affecting user-mode syscall verifiers for fuel gauge device properties. It arises from unchecked variable-length arrays sized by an attacker-controlled length parameter, leading to out-of-bounds writes on the kernel stack. This can allow a user-mode thread with appropriate permissions to overwrite kernel memory, potentially resulting in kernel code execution or system crashes.
The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). k_object_validate() short-circuits its type comparison when the requested type is K_OBJ_ANY, so the check reduced to "this pointer is the base address of some kernel object the calling thread has been granted" — the object's actual type was never compared, and K_SYSCALL_OBJ_INIT also skips the initialization-state check. The sibling handlers z_vrfy_device_init() and z_vrfy_device_is_ready() already used K_OBJ_DRIVER_ANY and were unaffected.
A thread running in user mode can therefore pass any kernel object it holds permission on — most usefully a thread stack object obtained from the k_thread_stack_alloc() syscall or a statically defined K_THREAD_STACK it was granted in order to spawn a child user thread — whose backing memory is writable from user mode. z_impl_device_deinit() then interprets those attacker-written bytes as a struct device: it dereferences the state pointer read out of the object, calls the function pointer read out of ops.deinit, and on success writes through state again. The result is an indirect call to an arbitrary address executed in supervisor mode, plus an arbitrary kernel read and a single-byte kernel write.
Exploitation gives a local unprivileged thread full kernel code execution, defeating the CONFIG_USERSPACE isolation boundary entirely; a less precise attempt yields a supervisor-mode fault and a system crash. The defect is only reachable in builds that enable both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT — with de-initialization support disabled, z_impl_device_deinit() returns -ENOTSUP without ever dereferencing the pointer. In v4.2.x and v4.3.x, CONFIG_DEVICE_DEINIT_SUPPORT defaulted to y, so every CONFIG_USERSPACE build of those releases is exposed unless the option was explicitly turned off. From v4.4.0 the option is opt-in (no default, and not selected by any in-tree subsystem), so a v4.4.x build is exposed only if it enables the option explicitly. The v4.2 line is no longer maintained and receives no backport.
The fix changes the object check to K_OBJ_DRIVER_ANY, which constrains the argument to the build-generated driver object type range (K_OBJ_DRIVER_FIRST..K_OBJ_DRIVER_LAST) — the real struct device instances placed by the linker — so the state and ops.deinit fields are once again kernel-controlled.