Zephyr vulnerabilities

This CVE has been rejected as a duplicate. The described vulnerability involved incorrect permission checking in the Bluetooth GATT notify/indicate paths in the Zephyr stack, but was already reported as CVE-2026-2411.

CVE-2026-10676 has been withdrawn as analysis determined that the reported defect is not reachable in any released version of Zephyr. In every supported release, the affected value is corrected before use.

Zephyr OS has a memory corruption vulnerability in the HTTP server WebSocket upgrade path. An unauthenticated remote attacker can trigger it by sending a crafted Sec-WebSocket-Key header. The bounded copy does not guarantee NUL termination, leading to out-of-bounds read/write on stack.

Zephyr's WireGuard implementation mishandled keepalive packets. A type-4 message with a 16-byte payload (empty plaintext plus Poly1305 tag) was accepted without tag verification because wg_process_data_message() returned early before calling wg_decrypt_packet(). An attacker could send a forged keepalive without knowing the session key.

Vulnerability in Zephyr's WireGuard VPN: wg_process_data_message() validated the anti-replay counter too late, after committing peer-state changes (address update, timers, key rotation). An attacker can re-inject a captured packet, leading to endpoint hijacking and session disruption.

The Zephyr virtio driver does not validate the descriptor-chain head id written by the virtio device into the used ring. A malicious virtio backend can supply an out-of-range id, causing an out-of-bounds read and invocation of an attacker-controlled function pointer in the guest's interrupt context. This enables control-flow hijacking or a reliable crash.

A vulnerability in the NVS backend of the Zephyr settings subsystem (settings_nvs.c) causes an out-of-bounds stack write. The nvs_read() function returns the full entry length, which can exceed the buffer size, and the code uses this value as an index for writing a NUL character, leading to a write past the buffer (CWE-787).

A vulnerability in Zephyr RTOS's PTP receive handler allows a remote attacker to trigger an out-of-bounds read by sending a crafted PTP packet with an invalid message type (0xE or 0xF). The lack of an upper-bound check on the msg_size[] array index leads to reading beyond the array and subsequent memory operations, potentially causing a crash or limited memory corruption.

Zephyr's 6LoWPAN IPHC uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table (13 entries) using an index built from the M, DAC and DAM bits of the IPHC dispatch word; reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table.

A use-after-free vulnerability exists in Zephyr's dynamic kernel-object disposal path. The unref_check() function frees object storage when the reference count reaches zero, but for timers (K_OBJ_TIMER) it does not cancel the active timeout, leaving a dangling node in the global timeout queue. When the timer expires, the kernel invokes the expiration handler on freed memory, causing a write to freed heap.

A use-after-free vulnerability exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler work_timeout() is in flight (blocked acquiring the work-queue spinlock), a concurrent cancellation does not wait for that handler to finish. This allows k_work_cancel_delayable_sync() and k_work_flush_delayable() to return without blocking, and freeing the object leads to a use-after-free read and write.

The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-side copy, but then re-read the still-live user struct for subsequent decisions. A double-fetch/TOCTOU allows a cooperating thread to inflate msg->msg_iovlen, leading to out-of-bounds writes in the kernel heap. This can result in local privilege escalation or kernel denial of service.

In the Intel ALH driver function dai_alh_get_properties(), lack of range validation for stream_id leads to an out-of-bounds read and kernel information leak. The vulnerability can be exploited from user mode if access to the ALH device is granted.

A vulnerability in the Zephyr USB CDC NCM driver causes a buffer overflow when handling GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE requests. A host can send a request with a wLength smaller than the response structure size, leading to an out-of-bounds write of up to 27 bytes.

The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download(). An attacker controlling the USB host can cause a device crash (denial of service) by sending a zero-length DFU_DNLOAD request.

On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the Floating point ABI choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the callee-saved FP registers (s16-s31 / d8-d15) are only saved and restored across a context switch when CONFIG_FPU_SHARING is enabled, and prior to this fix selecting an ABI did not enable FPU register sharing, which defaults off.

A vulnerability in tls_opt_dtls_peer_connection_id_value_get() in Zephyr (subsys/net/lib/sockets/sockets_tls.c) causes an out-of-bounds write in the kernel. The function passes the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer is at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. In CONFIG_USERSPACE builds, an unprivileged thread can trigger a kernel buffer overflow by passing a small optlen on a connected DTLS socket with Connection ID enabled.

In Zephyr's Bluetooth Mesh subnet key management, one PSA Crypto key slot leaks on every subnet-key teardown. net_keys_create() imports the Private Beacon Key into a PSA key slot, but subnet_keys_destroy() guarded psa_destroy_key() with CONFIG_BT_MESH_V1d1, which was removed, so the slot is never freed. With the default 16 slots, after roughly 12 add/delete or key-refresh cycles the slot pool is exhausted, preventing new subnet creation and causing errors for other PSA Crypto consumers.

A vulnerability in Zephyr's Bluetooth host causes incorrect permission checks when sending GATT notifications and indications. Passing the Characteristic Declaration attribute leads to checking declaration permissions instead of the characteristic value's security requirements, bypassing encryption or authentication.

The net_dhcpv4_msg_type_name() function in Zephyr DHCPv4 indexes a static name table after a faulty bounds check. Using sizeof instead of ARRAY_SIZE allows out-of-bounds read for message-type values from 9 up to 32 (or 64). The msg_type value originates from an unchecked raw byte from a received DHCP packet.

In Zephyr OS, a vulnerability exists in the IPv6 forwarding path where the hop limit is not decremented. This allows an IPv6 router to forward packets indefinitely, leading to network congestion and resource exhaustion.

In the Zephyr Bluetooth GATT client, in the gatt_write_ccc_rsp() function, a use-after-free vulnerability exists. Upon receiving an ATT Error Response from a GATT server, the function calls the notify(NULL) callback signaling subscription termination, then calls the subscribe() callback on the already freed structure, leading to use-after-free.

In the Zephyr system, the print_coredump_hdr() function uses the 16-bit tgt_code field from a coredump header as an index into a fixed 7-element array without bounds checking. A tgt_code >= 7 causes an out-of-bounds read, potentially disclosing device memory or causing a crash.

In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() allocates a thread permission index from the global _thread_idx_map[] bitmap without holding lists_lock. On SMP systems, two user threads concurrently calling k_object_alloc(K_OBJ_THREAD) can observe the same free bit, perform the same non-atomic RMW, and return the identical tidx.

Vulnerability in Zephyr's ext2 file system allows a DoS attack via a crafted ext2 image. The superblock validator does not check if s_blocks_per_group and s_inodes_per_group are non-zero, leading to division by zero during mount. On ARMv7-M/ARMv8-M platforms, this causes a fatal error and denial of service.

In the DesignWare SPI driver (drivers/spi/spi_dw.c) in Zephyr up to v4.4.0, lack of validation of config->frequency allows an unprivileged thread with access to the SPI device to trigger an unsigned integer divide-by-zero. This causes a CPU exception and local denial of service. Requires CONFIG_USERSPACE=y and granted permissions.

A vulnerability in Zephyr (MCTP-over-I2C+GPIO) allows an attacker to write an arbitrary byte via an uninitialized pointer and a one-byte heap overflow. Lack of validation of write order and receive buffer enables remote memory corruption or system crash.

In Zephyr Bluetooth Mesh PB-ADV provisioning bearer, the protocol watchdog timer is unconditionally reset before FCS and ADV_LINK_INVALID checks. A remote unauthenticated attacker can send FCS-valid PB-ADV PDUs on the same link ID, continuously resetting the timer and preventing the dead link from being torn down. This results in a persistent denial of provisioning/re-provisioning service, with no impact on confidentiality, integrity, or memory safety.

The Zephyr ADIN2111/ADIN1110 Ethernet driver in OA SPI mode lacks a bounds check when reassembling frames, allowing an attacker on the same Ethernet segment to cause an out-of-bounds write and potentially execute code.

In Zephyr's kernel pipe implementation, the syscall verifier z_vrfy_k_pipe_init() uses K_SYSCALL_OBJ() instead of K_SYSCALL_OBJ_NEVER_INIT(), allowing an unprivileged thread to re-initialize an already-in-use pipe. Re-initialization resets buffers and wait queues without waking blocked threads, leaving them orphaned and corrupting kernel structures.

In Xtensa systems with MPU and userspace enabled, arch_buffer_validate() defaulted to 0 (access permitted), allowing validation bypass when the rounded buffer extent wraps the 32-bit address space. An unprivileged user thread could pass crafted (addr, size) to any syscall validating user buffers, gaining access to kernel or other-partition memory.

A use-after-free vulnerability was found in Zephyr's dynamic kernel-object tracking mechanism. In SMP configurations with userspace and dynamic objects enabled, unsynchronized operations on a doubly-linked list can lead to kernel memory corruption.

In Zephyr's USB host stack (CONFIG_USB_HOST_STACK), a use-after-free and double-free vulnerability exists. The usbh_device_disconnect() function frees the root object without clearing ctx->root, and UHC drivers generate removal events without guards, allowing an attacker with physical USB access to trigger double memory free.

In the Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) in Zephyr v4.4.0, a NULL pointer dereference vulnerability exists. During FTL disk initialization, on a flash read error (e.g., uncorrectable ECC), the error code is written through a potentially NULL err pointer, causing a kernel panic and denial of service.

A vulnerability in the Zephyr Bluetooth ISO Adaptation Layer (isoal.c) allows a remote attacker to trigger an out-of-bounds read due to improper validation of the framed ISO PDU start segment length. Missing check that the segment length is at least 3 bytes causes an underflow during subtraction, copying up to 255 bytes of controller memory beyond the received PDU into an HCI ISO packet.

A race condition in Zephyr's asynchronous SNTP client closes the UDP socket from the calling thread without synchronizing with the poll thread, leading to use-after-free of net_context structures.

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device initiates teardown (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc() calls rfcomm_session_disconnected(), which unconditionally forces the session to BT_RFCOMM_STATE_DISCONNECTED without calling bt_l2cap_chan_disconnect(). This permanently wedges the session: the L2CAP channel is never released and the session slot in the bt_rfcomm_pool[] array is never reclaimed.

In Zephyr's BSD-sockets getaddrinfo() implementation, a use-after-return vulnerability occurs when a semaphore wait times out. The code retries the DNS query without canceling the previous one, leaving a stack pointer as user_data. A delayed DNS response or resolver timeout can overwrite stack memory, causing crashes or memory corruption.

In Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client, a NULL pointer dereference vulnerability exists. The unicast_client_ep_qos_state() function writes attacker-controlled QoS fields through the stream->qos pointer, which can be NULL when the stream is codec-configured but not added to a unicast group. A remote ASCS server can send a GATT notification announcing QoS Configured state while the local endpoint is in Codec Configured state, causing a write through NULL and a system crash.

In Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c), there is an out-of-bounds write vulnerability in the control buffer (msg_control). The validation only checks the payload length (msg_controllen < pktinfo_len), omitting the cmsg header size, allowing a write of up to 12 bytes past the buffer.

The IPv6 stack in Zephyr can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. Repeating the malicious packet exhausts all RX buffer slots, after which the device can no longer obtain RX buffers and stops receiving traffic, resulting in a denial of service.

A vulnerability in the Zephyr Bluetooth stack (subsys/bluetooth/host/iso.c) allows a malicious controller or adjacent BLE peer to send a short ISO packet, causing an out-of-bounds buffer read and, in the fragmented case, an out-of-bounds write. The issue exists from v2.6.0 to v4.4.0 and affects builds with ISO receive enabled (CONFIG_BT_ISO_RX).

A buffer over-read vulnerability was found in the Bluetooth BR/EDR stack of Zephyr in the bt_sdp_parse_attribute() function. An attacker can send a specially crafted SDP record of exactly 3 bytes, causing a one-byte read past the end of the buffer. Affects versions 4.3.0 and 4.4.0; fixed by adding proper length checks.

A buffer overflow vulnerability exists in Zephyr's Bluetooth Classic Hands-Free Profile (HFP) driver. The cind_handle_values() function fails to validate the index against the 20-element ind_table[] array, allowing a remote attacker (malicious AG) to write a controlled value out of bounds, causing memory corruption and potential denial of service of the Bluetooth stack.

A use-after-free vulnerability was found in Zephyr's IPv6 Neighbor Discovery send paths (NA, NS, RS). After a packet is successfully sent, the code accesses the already-freed packet structure, potentially causing a system crash or limited memory corruption.

A use-after-free vulnerability exists in Zephyr's native IPv4 stack in icmpv4_handle_echo_request(). After sending an ICMP Echo Reply, the code reads the interface pointer from a freed packet, potentially causing memory read or write via a stale pointer. The issue is present from v1.14 (2019) to v4.4.0.

A use-after-free vulnerability exists in Zephyr's networking stack (subsys/net/ip/icmpv6.c) when handling ICMPv6 packets. After sending an echo reply or ICMPv6 error, the code reads the network interface from a freed packet, leading to a dangling pointer dereference.

In the Zephyr network stack, the mld_send() function reads the network interface from a packet after it has been freed by the L2 driver. This can lead to a use-after-free condition, potentially causing a NULL-pointer dereference or memory corruption if the freed slot is concurrently reallocated.

In Zephyr's IPv4 IGMP implementation, a use-after-free vulnerability exists in igmp_send() which reads the network interface pointer after the packet has been sent. This affects versions from v2.6.0 through v4.4.0.

In Zephyr OS on Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, arch_mem_domain_deinit() fails to remove the domain node from the global xtensa_domain_list, leaving a dangling pointer. Subsequent memory mapping/unmapping operations may trigger NULL pointer dereference or use-after-free, causing system crash or userspace isolation breach.