Threats affecting pkg:github/Zephyr

CVE-2026-17052 is a memory-safety vulnerability in the Zephyr project affecting the Time-aware GPIO syscall handler z_vrfy_tgpio_pin_read_ts_ec(). The handler omitted a required K_SYSCALL_MEMORY_WRITE() validation, allowing an unprivileged user-mode thread with access to the TGPIO device to perform arbitrary writes to kernel memory. This write-what-where primitive can lead to privilege escalation or system crashes. The issue affects Zephyr versions from 3.5.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.4.2. The vulnerability is patched in versions 4.3.2 and 4.4.2.

CVE-2026-17051 is a vulnerability in the Intel SEDI IPM driver of the Zephyr project that allows an out-of-bounds write due to improper bounds checking of a message length field. The driver reads a length value from a peer-written doorbell register and uses it to copy data into a fixed-size buffer without verifying the length against the buffer size. This can cause a buffer overflow of up to 895 bytes in interrupt context, corrupting kernel data structures and potentially causing a system crash. The flaw affects Zephyr versions from 3.5.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.4.2. Fixed versions are 4.3.2 and 4.4.2.

CVE-2026-17050 is a use-after-free vulnerability in the experimental USB host stack of Zephyr OS. It occurs when a per-device configuration-descriptor buffer is freed multiple times due to improper pointer handling after certain USB descriptor read failures. This can lead to a double free on a dedicated heap, causing either a deterministic denial of service via kernel panic or heap corruption that may allow memory corruption. The vulnerability affects Zephyr versions 4.1.0 through before 4.3.2 and 4.4.0 through before 4.4.2. A fix is available in versions 4.3.2 and 4.4.2, which nullifies the pointer after freeing to prevent double free.

CVE-2026-16515 is a denial-of-service vulnerability in the Zephyr project's IPv6 ICMP error handling. The function net_icmpv6_send_error() does not fully implement RFC 4443 suppression rules, allowing an unauthenticated attacker on the same link to cause multiple Zephyr nodes to send ICMPv6 error messages to a victim, amplifying traffic and degrading network availability. This can be exploited by sending specially crafted IPv6 packets with spoofed source addresses or multicast source addresses, causing link flooding especially on constrained mesh networks. The vulnerability does not cause memory corruption but impacts availability.

gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce->steps_removed (accepted up to 254), never from announce->tlv.len, which is the field that states how many identities the TLV actually carries. Because path_sequence is the flexible member of the wire TLV (struct gptp_path_trace_tlv) and GPTP_ANNOUNCE() yields a raw pointer into the received packet buffer, the memcmp() inside the loop can address memory well past the end of the received frame. The stack's only length validation, GPTP_ANNOUNCE_CHECK_LEN(), requires the received gPTP payload to be exactly 68 + tlv.len bytes — so it does not constrain the loop, it guarantees the data is absent. An unauthenticated attacker on the same Ethernet segment can send a single Announce frame declaring tlv.len = 0 with steps_removed = 254; the frame passes the length check and reception path (net_gptp_recv() → gptp_handle_msg() → gptp_mi_qualify_announce()), which performs no authentication, and the loop then reads 255 entries of 8 bytes each — about 2 KB — beyond the end of the network buffer. The impact is an out-of-bounds read. The bytes read are only used as a memcmp() operand and are never returned to the attacker, so there is no meaningful information disclosure; the practical risk is that the overread crosses a network buffer pool boundary into unmapped or MPU-protected memory and faults the networking RX thread, causing a denial of service. Exposure is limited to builds that enable the opt-in, experimental CONFIG_NET_GPTP (TSN/AVB deployments) and to attackers with layer-2 adjacency, since gPTP frames are sent to a link-local multicast address and are not routed. The fix computes the true entry count as tlv.len / GPTP_CLOCK_ID_LEN and rejects the announce when steps_removed + 1 exceeds it, so the loop can no longer run past the data the packet-length check proved present.

CVE-2026-16512 is a vulnerability in the Zephyr project's gPTP implementation where the gptp_handle_msg() function processes Ethernet frames without properly validating that the payload is large enough to contain a full gPTP header. This can lead to out-of-bounds reads of memory when truncated frames are received from unauthenticated peers on the same link. The issue affects Zephyr versions from 1.13.0 up to but not including 4.3.2 and from 4.4.0 up to but not including 4.4.2. The vulnerability has a low severity impact with no write or availability effects. Fixed versions are 4.3.2 and 4.4.2.

The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data->w_index] and only checks data->w_index against sizeof(data->target_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow. The running index data->w_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data->w_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->target_out_buffer and following static device data. The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store.

CVE-2026-16148 is a denial of service vulnerability in the Zephyr project's it82xx2 USB device-controller driver. The issue arises from improper handling of a delayable work item during enable/disable cycles, leading to kernel panic. An external USB host can trigger this by controlling suspend/resume timing and repeatedly enabling/disabling the device. The vulnerability does not impact confidentiality or integrity but causes unauthenticated denial of service. Fixed versions are 4.3.2 and 4.4.2.

The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_out() the active transfer buffer is obtained with udc_buf_peek() (which does not dequeue it); when a full max-packet-size packet arrives but the buffer still has tailroom (the transfer is not yet complete), the pre-fix code both re-arms the endpoint to keep filling that same buf via work_handler_xfer_continue() and simultaneously hands the same, still-being-filled buffer to the upper stack with udc_submit_ep_event(). Because udc_submit_ep_event() transfers ownership of the buffer to the USB device stack (usbd_event_carrier() appends &buf->node to uds_ctx->ep_events, after which the class handler processes and net_buf_unref()s it), the driver continues to DMA subsequent host-controlled OUT packets into a buffer the upper stack may already have freed and recycled — a use-after-free write. In addition, since the buffer was never dequeued, the completing packet runs udc_buf_get() on the same object and submits it a second time, appending &buf->node to the event slist twice (singly-linked-list corruption) and causing a double net_buf_unref(). The IT82xx2 is a USB peripheral controller, so the untrusted USB host controls OUT-transfer packetization and can force this path against any non-control OUT endpoint whose queued buffer exceeds one packet — an ordinary bulk/interrupt pattern. The driver and USB device stack run in kernel context above the external host, giving the host a device-side kernel heap-corruption primitive: a reliable denial of service and, because the written bytes are attacker-controlled, plausible corruption of adjacent net_buf pool memory. The vector is physical (USB attach). The fix defers submission until the buffer is completely filled and lets xfer_work_handler() drive continuation, so each OUT buffer is submitted to the upper stack exactly once.

Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_get(), tls_session_cache_reset(), and the settings restore handler — allocate, free, and dereference each entry's heap buffer (entry->session). Before the fix these accesses were serialized only by the per-socket context mutex ctx->lock (assigned per socket in ctx_set_lock()), which provides no mutual exclusion between different sockets touching the shared cache. Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, any two concurrent client sockets contend for the same slot. A thread in tls_session_get() reading entry->session inside mbedtls_ssl_session_load() can run concurrently with another thread in tls_session_save() that selects the same entry for reuse and executes mbedtls_free(entry->session) before reallocating — a use-after-free read, and a double-free when two saves evict the same entry. Both corrupt the mbedTLS heap. The cache is reached on ordinary client paths: at connect time via tls_session_store()/tls_session_restore(), and (on main) whenever a TLS 1.3 session ticket arrives during recv()/poll() via tls_session_store_current(). Exploitation requires an application that opts into per-socket client session caching (the TLS_SESSION_CACHE socket option, off by default) and runs concurrent TLS client connections on multiple threads; the timing that opens the window is influenced by the remote peer(s), so a malicious or compromised server can raise session-ticket frequency to widen it. The reliably-demonstrable impact is memory corruption leading to a crash or heap corruption (denial of service). The fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache, serializing all reads and frees and closing the race.

CVE-2026-15893 is a denial of service vulnerability in the Zephyr project affecting its IPv6 neighbor discovery implementation. An attacker can send a malicious Router Advertisement with a Reachable Time value of 1, causing the reachable time calculation to return zero. This leads to either a fatal kernel assertion failure on builds with assertions enabled or continuous neighbor re-solicitation on builds without assertions, degrading network availability. The vulnerability affects Zephyr versions from 1.7.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.4.2. Fixed versions are 4.3.2 and 4.4.2. The impact is limited to availability with no confidentiality or integrity effects.

CVE-2026-15923 is a denial-of-service vulnerability in the Zephyr SDIO subsystem. It occurs when the SDIO card reports a maximum block size of zero, causing an infinite loop that hangs the calling thread and blocks access to the SDIO peripheral. This can only be exploited by inserting a malicious or malfunctioning SDIO card. There is no impact on memory safety, confidentiality, or integrity, only availability. The issue is fixed in Zephyr versions 4.3.2 and 4.4.2.

CVE-2026-15892 is a denial of service vulnerability in the Zephyr project's mcumgr SMP settings-management handlers. When configured to use heap buffers and an access hook that rejects requests, the handlers leak heap memory on each rejected request. This leak eventually exhausts the kernel heap, causing k_malloc() failures and service denial. The vulnerability affects versions from 3.5.0 up to but not including 4.4.2. The impact is limited to availability with no memory corruption or information disclosure.

CVE-2026-15891 is a memory-safety vulnerability in the Zephyr MQTT-SN client keepalive handler that can cause a NULL pointer dereference leading to a crash or kernel panic. This occurs when the client fails to receive PINGRESP messages from a gateway after retrying, allowing a remote attacker to trigger a denial of service. The issue affects Zephyr versions from 4.1.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.4.2. Fixed versions are 4.3.2 and 4.4.2.

The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match_data match_data inside struct hl78xx_gnss_data. The generic NMEA0183 match helper (drivers/gnss/gnss_nmea0183_match.c) requires that context to be the first member because its callbacks cast user_data directly to struct gnss_nmea0183_match_data . In the affected releases match_data was the second member (after const struct device dev), so it sat at a non-zero offset while gnss_nmea0183_match_init() initialized it at the correct address. The registered NMEA handlers instead pass the whole device data object (data->devices.gnss->data, offset 0), producing an offset-shifted type confusion between where state is initialized and where the parse callbacks read and write it. When NMEA sentences from the GNSS receiver are parsed, the GGA/RMC callbacks write parsed fix data into the wrong location within the struct, and the GSV callback (gnss_nmea0183_match_gsv_callback, active under CONFIG_GNSS_SATELLITES) reads its satellites pointer and bound from the wrong offsets — non-pointer bytes of struct hl78xx_gnss_data — and then writes parsed struct gnss_satellite entries through that bogus pointer. This is a write through an uninitialized/wild pointer with a garbage bound. The NMEA handlers are registered by default (CONFIG_HL78XX_GNSS_SOURCE_NMEA is the default GNSS source) on devices using the HL78xx GNSS. The driver runs in kernel context and the NMEA data originates from the GNSS radio front-end, so a party able to influence the GNSS signal (for example GNSS/GPS spoofing at radio proximity) can drive the kernel-side parser into the faulty write. The most likely impact is a crash (denial of service) because the bogus pointer resolves to a fixed near-NULL value, with adjacent-memory corruption possible on MMU-less targets. Confidentiality is not affected. Exploitation requires the satellites feature to be enabled and active, so attack complexity is high.

CVE-2026-15460 is a vulnerability in the Zephyr project's Bluetooth Classic L2CAP receive handler. It allows a remote attacker within radio range to send data to a channel that is not yet fully connected or authenticated, causing the system to process data on a half-open channel. This can lead to denial of service through channel or link teardown and a dangling-pointer condition due to stale channel state. The issue is fixed by adding a state check to ensure data is only processed on fully connected channels.

CVE-2026-14697 is a denial of service vulnerability in Zephyr's IPv6 Neighbor Solicitation handling. The net_ipv6_send_ns() function leaks transmit packets when multiple requests for the same unresolved neighbor occur, exhausting the transmit packet pool. This causes the affected node to be unable to send any network packets, resulting in persistent network unavailability until reboot. The issue affects Zephyr versions 4.3.0 through before 4.3.2 and 4.4.0 through before 4.4.2. A fix is available in versions 4.3.2 and 4.4.2.

When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called eth_bridge_handle_locally() and returned NET_OK. That helper does not consume the packet — it only calls bridge_iface_recv() (via virtual_recv()), which returns NET_CONTINUE without taking ownership of pkt. The NET_OK verdict then propagates through ethernet_recv() up to processing_data() in subsys/net/ip/net_core.c, where NET_OK is interpreted as "the packet was consumed, do not free it." Because no consumer actually took ownership, the RX net_pkt is never returned to the pool and is leaked. The concretely reproducible leak occurs for frames whose EtherType has no registered L3 handler when CONFIG_NET_ETHERNET_FORWARD_UNRECOGNISED_ETHERTYPE is set (default y when CONFIG_NET_SOCKETS_PACKET is enabled): the fall-through L3 dispatch does not overwrite the NET_OK verdict, so ethernet_recv() returns NET_OK and the buffer is never released. Any device on a bridged L2 segment can emit broadcast/multicast frames carrying an arbitrary EtherType with no authentication. Each such frame permanently consumes one buffer from the finite RX pool (CONFIG_NET_PKT_RX_COUNT), so a brief broadcast flood exhausts the pool and the device can no longer receive traffic until it is rebooted — a persistent denial of service. There is no confidentiality or integrity impact. The fix makes eth_bridge_handle_locally() propagate the real net_verdict and return NET_CONTINUE for locally-kept frames, writing the bridge interface back through a new dst_iface out-parameter so the packet follows the normal receive path and is unreferenced exactly once.

CVE-2026-14368 is a medium-severity vulnerability in the Zephyr project's LwM2M JSON content formatter. It involves an off-by-one buffer overflow caused by improper boundary checking when copying a JSON string into a fixed-size buffer. This overflow writes a single null byte immediately past the buffer, potentially corrupting adjacent memory and causing data corruption or a crash. The flaw is triggered by a malicious LwM2M server sending a string resource with a length exactly equal to the buffer size during a WRITE operation. The issue is fixed in Zephyr versions 4.3.2 and 4.4.2 by correcting the boundary check to reject strings that exactly match the buffer length.

CVE-2026-14367 is a race condition vulnerability in the Zephyr project's I3C IBI subsystem. It arises from unsynchronized access to a statically allocated free-list of work nodes used in interrupt and thread contexts, leading to potential list corruption. An attacker with physical access to the I3C bus can trigger high-frequency interrupts to exploit this race. The most likely impact is a denial of service via system crash or hang, with memory corruption possible but difficult to control. The issue is fixed in Zephyr versions 4.3.2 and 4.4.2 by introducing spinlock protection around the free-list operations.