CVE-2026-75085 is a medium-severity vulnerability in the Zephyr project's STM32WBA IEEE 802.15.4 driver. The driver incorrectly calculates the packet length of received frames without validating that the length can hold the Frame Check Sequence (FCS). This leads to an underflow and an out-of-bounds read of adjacent memory when processing malformed frames. The issue is fixed in Zephyr versions 4.3.2 and 4.5.0 by adding proper length validation and runtime checks to drop oversized frames.
CVE-2026-75084 is a vulnerability in the Zephyr project's CC1200 sub-GHz IEEE 802.15.4 driver. The driver improperly validates the PHY packet length, allowing an attacker within radio range to send a frame with an invalid length byte exceeding the IEEE 802.15.4 maximum. This leads to a buffer overflow in the network buffer pool, causing corruption and potential crashes. The flaw affects builds with CONFIG_IEEE802154_CC1200 enabled and an attached CC1200 radio. No authentication or user interaction is required for exploitation.
CVE-2026-19673 is a vulnerability in the Zephyr project affecting Ethernet frame processing when VLAN is enabled on the interface. The issue arises because the ethernet_recv() function improperly validates buffer lengths when handling VLAN-tagged frames, leading to out-of-bounds reads and buffer underflows. This can cause a remote denial of service and potential information disclosure or memory corruption. Only configurations with VLAN enabled and without hardware VLAN tag stripping are affected. The vulnerability has a CVSS score of 7.1 (high severity).
CVE-2026-75083 is an integer overflow vulnerability in the NXP KW41Z IEEE 802.15.4 driver of the Zephyr project. The flaw arises from improper handling of the frame length field, allowing an attacker within radio range to cause a buffer overflow in the network buffer pool. This can lead to memory corruption and likely crashes. The vulnerability is fixed in Zephyr versions 4.3.2 and 4.5.0.
CVE-2026-19940 is a use-after-free vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) implementation of the Zephyr project. It occurs due to improper handling of work items in a static pool during link teardown and re-creation, leading to kernel timeout list corruption. This results in system faults or hangs, causing denial of service. The vulnerability affects Zephyr versions from 4.2.0 up to but not including 4.5.0 and requires the experimental CONFIG_BT_HFP_AG enabled with the asynchronous get_ongoing_call callback implemented.
CVE-2026-19939 is a memory-safety vulnerability in the Zephyr project's Bluetooth AVDTP signalling layer affecting versions from 3.7.0 up to but not including 4.5.0. It arises when a remote Bluetooth BR/EDR peer manipulates the AVDTP signalling channel by disconnecting and reconnecting within a timeout window, causing a delayable work item to remain linked after its memory is zeroed. This leads to kernel data structure corruption and can cause system-wide crashes or hangs. The issue requires an encrypted BR/EDR link and the experimental CONFIG_BT_A2DP feature enabled. A fix is available in version 4.5.0 that properly cancels the timeout work and initializes the work item during session establishment.
CVE-2026-19938 is a use-after-free vulnerability in the Zephyr Bluetooth host ATT transmit path. It occurs when a buffer is incorrectly released upon signing failure during an ATT Signed Write Command on unencrypted connections with signing enabled. This leads to memory corruption, including list corruption, double frees, and out-of-bounds writes, potentially causing crashes or assertion failures. The vulnerability requires the deprecated CONFIG_BT_SIGNING feature to be enabled and an application issuing signed writes. It affects Zephyr versions >=2.3.0 <4.3.2 and >=4.4.0 <4.5.0 and is fixed in versions 4.3.2 and 4.5.0.
CVE-2026-19937 is a denial-of-service vulnerability in the Zephyr Bluetooth Mesh Access layer's delayable-message management. It arises from improper handling of a static pool of message contexts, leading to permanent loss of contexts under certain conditions. An attacker provisioned in the mesh network can exploit this by flooding the device with requests that cause transmit contexts to be occupied and chunk pool exhaustion, resulting in dropped replies from server models. The device continues processing traffic but silently drops all replies until rebooted. There is no memory corruption or data integrity impact.
CVE-2026-19936 is a race condition vulnerability in the Zephyr Bluetooth Mesh Access-layer delayable message queue. It arises from unsynchronized access to shared lists and a delayable work item between two cooperative threads, leading to a NULL pointer dereference and system workqueue thread abort. This causes loss of availability of the affected node but does not allow memory corruption or code execution. The vulnerability affects Zephyr versions from 3.6.0 up to but not including 4.3.2 and from 4.4.0 up to but not including 4.5.0. Fixed versions are 4.3.2 and 4.5.0.
CVE-2026-19740 is a denial-of-service vulnerability in the Zephyr Bluetooth LE Controller's Link Layer Control Procedure (LLCP) implementation. It involves improper handling of retained receive nodes during PHY Update procedures, leading to resource leaks or assertion failures. An attacker on an established LE connection can trigger this without pairing or encryption, causing Bluetooth to become inoperable until reboot. The issue affects Zephyr versions from 3.4.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.5.0. Fixed in versions 4.3.2 and 4.5.0. The impact is limited to availability with no memory corruption or information disclosure.
CVE-2026-19739 is a denial of service vulnerability in the Zephyr Bluetooth Link Layer controller. It occurs when the controller improperly retains a received RX node during a Connection Update or Connection Parameter procedure, leading to resource exhaustion or a fatal error. A remote attacker can trigger this without authentication by sending specific Bluetooth Link Layer control PDUs. The issue affects Zephyr versions from 3.4.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.5.0. Fixed in versions 4.3.2 and 4.5.0.
CVE-2026-19738 is a denial-of-service vulnerability in the Zephyr Bluetooth Link Layer Control Procedure for Connected Isochronous Stream creation. It occurs when certain invalid PDUs cause the connection to terminate without releasing retained memory nodes, leading to memory leaks and eventual exhaustion of the controller's notification pool. Exploitation requires no pairing or encryption and can cause system resets or stalled flow control, impacting availability. Fixed in Zephyr versions 4.3.2 and 4.5.0.
CVE-2026-19935 is a use-after-free vulnerability in the Zephyr Bluetooth LE host's L2CAP dynamic channel handling. It occurs when a remote peer sends a data K-frame followed immediately by a Disconnect Request, causing a race condition where a work item referencing a freed channel object is processed. This can lead to memory corruption or workqueue malfunction. The issue affects Zephyr versions from 2.0.0 up to but not including 4.5.0 and is fixed in version 4.5.0.
CVE-2026-19737 is a memory-safety vulnerability in the Zephyr project's i2s_esp32 driver affecting versions from 4.4.0 up to but not including 4.5.0. The issue arises when the driver dereferences NULL pointers for I2S directions not implemented by the device, leading to a kernel-mode read from address zero. This can be triggered by an unprivileged user-mode thread with access to the I2S device, causing a system-wide denial of service due to a fatal exception. The vulnerability does not allow information disclosure or code execution. A fix has been merged that adds proper pointer checks and returns an error for unsupported directions.
CVE-2026-18418 is a low-severity vulnerability in the Zephyr project affecting the zbus proxy agent IPC backend. It involves improper handling of a non-NUL-terminated channel_name field in inter-domain frames, which can cause out-of-bounds reads during logging. This may lead to limited memory disclosure in logs or a potential fatal fault. The vulnerability requires specific configuration and conditions, including control over a peer domain's firmware and logging at warning level or above.
CVE-2026-19736 is a vulnerability in the NXP MCUX TRNG entropy driver used in Zephyr OS versions 4.3.0 through 4.4.x. The flaw arises because the driver passes the requested byte count directly to the vendor SDK's TRNG_GetRandomData() function, which only handles multiples of 4 bytes correctly. Requests for entropy with lengths not divisible by 4 cause an underflow in the SDK's buffer size check, leading to up to 127 bytes of memory being overwritten beyond the caller's buffer. This overflow can corrupt kernel memory or adjacent user memory partitions, potentially causing crashes or privilege escalation. The issue affects certain NXP i.MX RT5xx and RT6xx SoCs where the TRNG_SW_HEALTH_TESTS variant is enabled. The vulnerability is fixed in Zephyr version 4.5.0 by ensuring only word-aligned requests are passed to the SDK.
CVE-2026-19735 is a vulnerability in the Zephyr project's TCP initial sequence number (ISN) generation. A failure in the cryptographic random source during boot can cause the secret key used for ISN calculation to remain all zeros, making ISNs predictable. This weakens protection against blind TCP connection spoofing and data injection. The issue affects Zephyr versions >=3.7.0 <4.3.2 and >=4.4.0 <4.5.0 and is fixed in versions 4.3.2 and 4.5.0.
CVE-2026-19577 is a vulnerability in the Zephyr project affecting the IPv6 neighbor cache handling. It involves an out-of-bounds read when resolving the next-hop link-layer address for IPv6 packets. An unauthenticated attacker on the same link can trigger this by causing unresolved neighbor cache entries and then sending packets to those neighbors. This can lead to a denial of service via device panic if assertions are enabled, or information disclosure of static RAM contents if assertions are disabled.
CVE-2026-19576 is a vulnerability in the Goodix GT9xx input driver of the Zephyr project. The driver reads a touch point count from the controller and uses it unchecked as a loop bound to fill a stack array, leading to a potential stack buffer overflow. This overflow can cause out-of-bounds writes and reads, potentially allowing control-flow hijacking with kernel privileges. Exploitation requires physical or local hardware access to the I2C touch controller. The issue is fixed in Zephyr version 4.5.0 by clamping the reported touch count before array indexing.
CVE-2026-19669 is a memory safety vulnerability in the Zephyr project affecting the fuel gauge syscall handlers. It arises from unvalidated variable-length arrays sized by a user-supplied length, allowing out-of-bounds writes on the supervisor stack. This can lead to kernel memory corruption, potentially enabling kernel code execution or system crashes. The flaw is fixed in Zephyr versions 4.3.2 and 4.5.0.