CVE-2026-10677

The virtio PCI driver in Zephyr OS (drivers/virtio/virtio_pci.c) improperly validates the capability length (cap_len) read from PCI configuration space. The lack of runtime validation (assert is disabled in production builds) leads to an out-of-bounds write on the kernel stack during device initialization.

The UpdateHub OTA client in Zephyr OS contains an uninitialized heap memory read and out-of-bounds read in z_impl_updatehub_probe(). A malicious UpdateHub server can send a crafted response that, after a failed first JSON parse, uses a non-NUL-terminated metadata_copy buffer, leading to a read past the allocated memory and potentially crashing the device.

A vulnerability in the ATT layer of the Bluetooth stack in Zephyr OS leads to a use-after-free of channel memory. When a remote device disconnects during ongoing ATT traffic, a deferred callback may reference a freed channel, causing a system crash or potential memory corruption.

In Zephyr OS (since v2.5.0), the NXP LPUART driver disables peripheral clocks before validating configuration. Unsupported parameters cause an error without re-enabling the clock, leading to a hard fault and system crash.

A stack buffer overflow vulnerability exists in the parse_ipv4() function in Zephyr OS. An attacker can craft an IP address with a long suffix after the colon, causing data to be copied beyond the allocated 17-byte buffer. The issue has been present since v1.9.0 through v4.4.0 and can lead to system crashes or potential control-flow hijack.

In Zephyr OS, a vulnerability in the DNS resolver uses memcmp() to always compare 7 bytes with the ".local" suffix, even when the final hostname label is shorter. This causes an out-of-bounds read past the string terminator, potentially leading to a page fault and denial of service (DoS). The flaw is present only when CONFIG_MDNS_RESOLVER is enabled and exists since v1.10.0.

The MAX32xxx USB device controller driver (udc_max32.c) in Zephyr OS does not check if the endpoint buffer is NULL in the OUT and IN transfer-completion handlers. When a USB host sends a new SETUP packet during an ongoing EP0 transfer, the FIFO can be drained, causing a stale event to be processed, leading to a near-NULL pointer dereference and device crash.

In Zephyr OS, the mcumgr_serial_process_frag() function calls net_buf_reset() on the result of smp_packet_alloc() before checking for NULL. When the MCUmgr packet pool (default 4 buffers) is exhausted, smp_packet_alloc() returns NULL, and writing through the NULL pointer causes a system crash.

The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) has an unbounded loop in pl011_irq_tx_enable() that hangs the thread when CTS hardware flow control is enabled and the peer de-asserts CTS. The loop never exits because the TX FIFO cannot drain, causing a denial of service (CWE-835).