Zephyr vulnerabilities

A vulnerability in ethernet_recv() in subsys/net/l2/ethernet/ethernet.c in the Zephyr network stack. When the ethertype is 0x8100 and VLAN is enabled on the interface, the received frame buffer is reinterpreted as an 18-byte net_eth_vlan_hdr without re-checking the length, causing an out-of-bounds read and raising hdr_len to 18. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers the issue.

This CVE has been rejected as a duplicate. The described vulnerability involved incorrect permission checking in the Bluetooth GATT notify/indicate paths in the Zephyr stack, but was already reported as CVE-2026-2411.

CVE-2026-10676 has been withdrawn as analysis determined that the reported defect is not reachable in any released version of Zephyr. In every supported release, the affected value is corrected before use.

Zephyr OS has a memory corruption vulnerability in the HTTP server WebSocket upgrade path. An unauthenticated remote attacker can trigger it by sending a crafted Sec-WebSocket-Key header. The bounded copy does not guarantee NUL termination, leading to out-of-bounds read/write on stack.

A vulnerability in the Zephyr Bluetooth LE stack allows a remote, unauthenticated attacker to trigger a use-after-free in L2CAP CoC channel handling with dynamic PSMs. By sending a data frame followed by a disconnect request, the attacker can cause the system workqueue to process work referencing a freed channel, leading to memory corruption or workqueue corruption.

The LLCP implementation in Zephyr's Bluetooth LE Controller retains a receive node after accepting LL_PHY_UPDATE_IND, but invalid-PDU paths fail to release it before completing the procedure. An attacker can send a PDU sequence causing an assertion failure (device crash) or leaking nodes from the receive pool, leading to Bluetooth unavailability until reboot.

A vulnerability in Zephyr's syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() allocates variable-length arrays on the kernel stack sized directly by an unvalidated caller-supplied len argument. Because no bounds check occurs before allocation and copying, a user-mode thread (with CONFIG_USERSPACE) can trigger an out-of-bounds write in supervisor mode with attacker-controlled length and, on the permitted path, attacker-controlled content.

An out-of-bounds read vulnerability was found in the IPv6 subsystem of the Zephyr stack in net_route_ipv6_packet(). The issue stems from missing validation of whether a neighbor cache entry has a link-layer address before using it. An attacker on the same link can force an unresolved neighbor state and trigger an out-of-bounds read past the address array, potentially causing a system panic or data leak.

In the IEEE 802.15.4 stack in Zephyr, the function ieee802154_decipher_data_frame() does not check if the frame is long enough before computing the payload length. Subtracting the header and authentication tag length from the frame length can underflow, leading to an out-of-bounds read and write. An attacker within radio range can send a short frame, causing memory corruption and system crash.

The ieee802154_send() function in Zephyr's network stack copies an outgoing packet into a fixed 125-byte transmit buffer without validating its length. When 6LoWPAN fragmentation is enabled but not required, the missing size check allows an out-of-bounds write past the buffer. The flaw is reachable through NET_AF_PACKET sockets bound to an 802.15.4 interface, including from an unprivileged application thread in CONFIG_USERSPACE builds.

A vulnerability in the PSA Internal Trusted Storage module in Zephyr involves a lack of synchronization in nonce generation for AEAD encryption. The function secure_storage_its_transform_aead_get_nonce() uses unsynchronized function-local static variables, and concurrent writes to the same UID can lead to nonce reuse with the same key. This causes a catastrophic AEAD failure, enabling data leakage and forgery of stored entries.

The experimental USB host stack in Zephyr contains a double-free vulnerability in the configuration descriptor buffer. On three error paths, the buffer is freed but the pointer is left dangling, leading to a second free during cleanup. The vulnerability can be triggered by a malicious or malformed USB device.

The net_icmpv6_send_error() function in the Zephyr network stack implemented only one of the three RFC 4443 section 2.4 suppression rules, so it did not check whether the packet's source address identifies a single node or whether the packet was sent to a multicast destination. An unauthenticated attacker on the same link can send a single IPv6 packet to ff02::1 with a spoofed victim source, causing every Zephyr node to emit ICMPv6 Parameter Problem messages to that victim (reflection with amplification), or send a unicast packet with a multicast source address, turning it into a link-flooding multicast frame.

Zephyr's TLS socket layer (subsys/net/lib/sockets/sockets_tls.c) keeps a process-global client_cache array of cached client session buffers shared by every TLS socket, with access serialized only by the per-socket ctx->lock mutex. Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, two concurrent client sockets contend for the same slot, causing a use-after-free read and a double-free when two saves evict the same entry. This corrupts the mbedTLS heap; the fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache.

The Zephyr SDIO subsystem has a vulnerability in sdio_io_rw_extended_helper() where func->cis.max_blk_size is decoded from the SDIO card without validation. If a card reports a maximum block size of zero, the transfer loop never terminates, causing a thread hang and permanent mutex lock, leading to denial of service for the SDIO peripheral.

A vulnerability in the Bluetooth Classic (BR/EDR) stack in Zephyr RTOS affects the L2CAP receive handler, which dispatches inbound data PDUs based only on the destination channel ID without verifying that the channel has reached the BT_L2CAP_CONNECTED state. An attacker within radio range can send data to a channel during connection setup, before configuration and authentication complete. This can lead to delivery of attacker data to upper-layer protocols on a half-open channel and to use of stale or partially initialized channel state, causing denial of service or a potential dangling-pointer condition.

In the IPv6 subsystem of the Zephyr stack (subsys/net/ip/ipv6_nbr.c), the net_ipv6_send_ns() function allocates a transmit net_pkt for a Neighbor Solicitation. When called with a data packet pending on an unresolved neighbor and the neighbor's pending_queue is already non-empty, the function appends the data packet and returns early without sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT.

Zephyr's WireGuard implementation mishandled keepalive packets. A type-4 message with a 16-byte payload (empty plaintext plus Poly1305 tag) was accepted without tag verification because wg_process_data_message() returned early before calling wg_decrypt_packet(). An attacker could send a forged keepalive without knowing the session key.

Vulnerability in Zephyr's WireGuard VPN: wg_process_data_message() validated the anti-replay counter too late, after committing peer-state changes (address update, timers, key rotation). An attacker can re-inject a captured packet, leading to endpoint hijacking and session disruption.

The Zephyr virtio driver does not validate the descriptor-chain head id written by the virtio device into the used ring. A malicious virtio backend can supply an out-of-range id, causing an out-of-bounds read and invocation of an attacker-controlled function pointer in the guest's interrupt context. This enables control-flow hijacking or a reliable crash.

A vulnerability in the NVS backend of the Zephyr settings subsystem (settings_nvs.c) causes an out-of-bounds stack write. The nvs_read() function returns the full entry length, which can exceed the buffer size, and the code uses this value as an index for writing a NUL character, leading to a write past the buffer (CWE-787).

A vulnerability in Zephyr RTOS's PTP receive handler allows a remote attacker to trigger an out-of-bounds read by sending a crafted PTP packet with an invalid message type (0xE or 0xF). The lack of an upper-bound check on the msg_size[] array index leads to reading beyond the array and subsequent memory operations, potentially causing a crash or limited memory corruption.

Zephyr's 6LoWPAN IPHC uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table (13 entries) using an index built from the M, DAC and DAM bits of the IPHC dispatch word; reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table.

A use-after-free vulnerability exists in Zephyr's dynamic kernel-object disposal path. The unref_check() function frees object storage when the reference count reaches zero, but for timers (K_OBJ_TIMER) it does not cancel the active timeout, leaving a dangling node in the global timeout queue. When the timer expires, the kernel invokes the expiration handler on freed memory, causing a write to freed heap.

A use-after-free vulnerability exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler work_timeout() is in flight (blocked acquiring the work-queue spinlock), a concurrent cancellation does not wait for that handler to finish. This allows k_work_cancel_delayable_sync() and k_work_flush_delayable() to return without blocking, and freeing the object leads to a use-after-free read and write.

The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-side copy, but then re-read the still-live user struct for subsequent decisions. A double-fetch/TOCTOU allows a cooperating thread to inflate msg->msg_iovlen, leading to out-of-bounds writes in the kernel heap. This can result in local privilege escalation or kernel denial of service.

In the Intel ALH driver function dai_alh_get_properties(), lack of range validation for stream_id leads to an out-of-bounds read and kernel information leak. The vulnerability can be exploited from user mode if access to the ALH device is granted.

A vulnerability in the Zephyr USB CDC NCM driver causes a buffer overflow when handling GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE requests. A host can send a request with a wLength smaller than the response structure size, leading to an out-of-bounds write of up to 27 bytes.

The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download(). An attacker controlling the USB host can cause a device crash (denial of service) by sending a zero-length DFU_DNLOAD request.

On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the Floating point ABI choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the callee-saved FP registers (s16-s31 / d8-d15) are only saved and restored across a context switch when CONFIG_FPU_SHARING is enabled, and prior to this fix selecting an ABI did not enable FPU register sharing, which defaults off.

A vulnerability in tls_opt_dtls_peer_connection_id_value_get() in Zephyr (subsys/net/lib/sockets/sockets_tls.c) causes an out-of-bounds write in the kernel. The function passes the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer is at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. In CONFIG_USERSPACE builds, an unprivileged thread can trigger a kernel buffer overflow by passing a small optlen on a connected DTLS socket with Connection ID enabled.

In Zephyr's Bluetooth Mesh subnet key management, one PSA Crypto key slot leaks on every subnet-key teardown. net_keys_create() imports the Private Beacon Key into a PSA key slot, but subnet_keys_destroy() guarded psa_destroy_key() with CONFIG_BT_MESH_V1d1, which was removed, so the slot is never freed. With the default 16 slots, after roughly 12 add/delete or key-refresh cycles the slot pool is exhausted, preventing new subnet creation and causing errors for other PSA Crypto consumers.

A vulnerability in Zephyr's Bluetooth host causes incorrect permission checks when sending GATT notifications and indications. Passing the Characteristic Declaration attribute leads to checking declaration permissions instead of the characteristic value's security requirements, bypassing encryption or authentication.

The net_dhcpv4_msg_type_name() function in Zephyr DHCPv4 indexes a static name table after a faulty bounds check. Using sizeof instead of ARRAY_SIZE allows out-of-bounds read for message-type values from 9 up to 32 (or 64). The msg_type value originates from an unchecked raw byte from a received DHCP packet.

In Zephyr OS, a vulnerability exists in the IPv6 forwarding path where the hop limit is not decremented. This allows an IPv6 router to forward packets indefinitely, leading to network congestion and resource exhaustion.

In the Zephyr Bluetooth GATT client, in the gatt_write_ccc_rsp() function, a use-after-free vulnerability exists. Upon receiving an ATT Error Response from a GATT server, the function calls the notify(NULL) callback signaling subscription termination, then calls the subscribe() callback on the already freed structure, leading to use-after-free.

In the Zephyr system, the print_coredump_hdr() function uses the 16-bit tgt_code field from a coredump header as an index into a fixed 7-element array without bounds checking. A tgt_code >= 7 causes an out-of-bounds read, potentially disclosing device memory or causing a crash.

In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() allocates a thread permission index from the global _thread_idx_map[] bitmap without holding lists_lock. On SMP systems, two user threads concurrently calling k_object_alloc(K_OBJ_THREAD) can observe the same free bit, perform the same non-atomic RMW, and return the identical tidx.

Vulnerability in Zephyr's ext2 file system allows a DoS attack via a crafted ext2 image. The superblock validator does not check if s_blocks_per_group and s_inodes_per_group are non-zero, leading to division by zero during mount. On ARMv7-M/ARMv8-M platforms, this causes a fatal error and denial of service.

In the DesignWare SPI driver (drivers/spi/spi_dw.c) in Zephyr up to v4.4.0, lack of validation of config->frequency allows an unprivileged thread with access to the SPI device to trigger an unsigned integer divide-by-zero. This causes a CPU exception and local denial of service. Requires CONFIG_USERSPACE=y and granted permissions.

A vulnerability in Zephyr (MCTP-over-I2C+GPIO) allows an attacker to write an arbitrary byte via an uninitialized pointer and a one-byte heap overflow. Lack of validation of write order and receive buffer enables remote memory corruption or system crash.

In Zephyr Bluetooth Mesh PB-ADV provisioning bearer, the protocol watchdog timer is unconditionally reset before FCS and ADV_LINK_INVALID checks. A remote unauthenticated attacker can send FCS-valid PB-ADV PDUs on the same link ID, continuously resetting the timer and preventing the dead link from being torn down. This results in a persistent denial of provisioning/re-provisioning service, with no impact on confidentiality, integrity, or memory safety.

The Zephyr ADIN2111/ADIN1110 Ethernet driver in OA SPI mode lacks a bounds check when reassembling frames, allowing an attacker on the same Ethernet segment to cause an out-of-bounds write and potentially execute code.

In Zephyr's kernel pipe implementation, the syscall verifier z_vrfy_k_pipe_init() uses K_SYSCALL_OBJ() instead of K_SYSCALL_OBJ_NEVER_INIT(), allowing an unprivileged thread to re-initialize an already-in-use pipe. Re-initialization resets buffers and wait queues without waking blocked threads, leaving them orphaned and corrupting kernel structures.

In Xtensa systems with MPU and userspace enabled, arch_buffer_validate() defaulted to 0 (access permitted), allowing validation bypass when the rounded buffer extent wraps the 32-bit address space. An unprivileged user thread could pass crafted (addr, size) to any syscall validating user buffers, gaining access to kernel or other-partition memory.

A use-after-free vulnerability was found in Zephyr's dynamic kernel-object tracking mechanism. In SMP configurations with userspace and dynamic objects enabled, unsynchronized operations on a doubly-linked list can lead to kernel memory corruption.

In Zephyr's USB host stack (CONFIG_USB_HOST_STACK), a use-after-free and double-free vulnerability exists. The usbh_device_disconnect() function frees the root object without clearing ctx->root, and UHC drivers generate removal events without guards, allowing an attacker with physical USB access to trigger double memory free.

In the Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) in Zephyr v4.4.0, a NULL pointer dereference vulnerability exists. During FTL disk initialization, on a flash read error (e.g., uncorrectable ECC), the error code is written through a potentially NULL err pointer, causing a kernel panic and denial of service.

A vulnerability in the Zephyr Bluetooth ISO Adaptation Layer (isoal.c) allows a remote attacker to trigger an out-of-bounds read due to improper validation of the framed ISO PDU start segment length. Missing check that the segment length is at least 3 bytes causes an underflow during subtraction, copying up to 255 bytes of controller memory beyond the received PDU into an HCI ISO packet.

A race condition in Zephyr's asynchronous SNTP client closes the UDP socket from the calling thread without synchronizing with the poll thread, leading to use-after-free of net_context structures.