CVE-2026-5067

This CVE has been rejected as a duplicate. The described vulnerability involved incorrect permission checking in the Bluetooth GATT notify/indicate paths in the Zephyr stack, but was already reported as CVE-2026-2411.

CVE-2026-10676 has been withdrawn as analysis determined that the reported defect is not reachable in any released version of Zephyr. In every supported release, the affected value is corrected before use.

The ieee802154_send() function in Zephyr's network stack copies an outgoing packet into a fixed 125-byte transmit buffer without validating its length. When 6LoWPAN fragmentation is enabled but not required, the missing size check allows an out-of-bounds write past the buffer. The flaw is reachable through NET_AF_PACKET sockets bound to an 802.15.4 interface, including from an unprivileged application thread in CONFIG_USERSPACE builds.

A vulnerability in the PSA Internal Trusted Storage module in Zephyr involves a lack of synchronization in nonce generation for AEAD encryption. The function secure_storage_its_transform_aead_get_nonce() uses unsynchronized function-local static variables, and concurrent writes to the same UID can lead to nonce reuse with the same key. This causes a catastrophic AEAD failure, enabling data leakage and forgery of stored entries.

The experimental USB host stack in Zephyr contains a double-free vulnerability in the configuration descriptor buffer. On three error paths, the buffer is freed but the pointer is left dangling, leading to a second free during cleanup. The vulnerability can be triggered by a malicious or malformed USB device.

The net_icmpv6_send_error() function in the Zephyr network stack implemented only one of the three RFC 4443 section 2.4 suppression rules, so it did not check whether the packet's source address identifies a single node or whether the packet was sent to a multicast destination. An unauthenticated attacker on the same link can send a single IPv6 packet to ff02::1 with a spoofed victim source, causing every Zephyr node to emit ICMPv6 Parameter Problem messages to that victim (reflection with amplification), or send a unicast packet with a multicast source address, turning it into a link-flooding multicast frame.

Zephyr's TLS socket layer (subsys/net/lib/sockets/sockets_tls.c) keeps a process-global client_cache array of cached client session buffers shared by every TLS socket, with access serialized only by the per-socket ctx->lock mutex. Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, two concurrent client sockets contend for the same slot, causing a use-after-free read and a double-free when two saves evict the same entry. This corrupts the mbedTLS heap; the fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache.

The Zephyr SDIO subsystem has a vulnerability in sdio_io_rw_extended_helper() where func->cis.max_blk_size is decoded from the SDIO card without validation. If a card reports a maximum block size of zero, the transfer loop never terminates, causing a thread hang and permanent mutex lock, leading to denial of service for the SDIO peripheral.

A vulnerability in the Bluetooth Classic (BR/EDR) stack in Zephyr RTOS affects the L2CAP receive handler, which dispatches inbound data PDUs based only on the destination channel ID without verifying that the channel has reached the BT_L2CAP_CONNECTED state. An attacker within radio range can send data to a channel during connection setup, before configuration and authentication complete. This can lead to delivery of attacker data to upper-layer protocols on a half-open channel and to use of stale or partially initialized channel state, causing denial of service or a potential dangling-pointer condition.

In the IPv6 subsystem of the Zephyr stack (subsys/net/ip/ipv6_nbr.c), the net_ipv6_send_ns() function allocates a transmit net_pkt for a Neighbor Solicitation. When called with a data packet pending on an unresolved neighbor and the neighbor's pending_queue is already non-empty, the function appends the data packet and returns early without sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT.