CVE-2026-10667 is a high-severity vulnerability in Zephyr's dynamic kernel-object tracking. The vulnerability exists in the kernel/userspace/userspace.c file, where iteration over a doubly-linked list of dynamically allocated kernel objects is performed under lists_lock, but list removal and freeing of nodes is performed under different spinlocks. This can lead to a use-after-free vulnerability, allowing [truncated]
CVE-2026-10666 is a high-severity vulnerability in the Zephyr project's IPv4 address parsing functionality. The bug was introduced in Zephyr v1.9.0 and affects all releases up to v4.4.0. The vulnerability allows for potential memory corruption and denial of service via crafted address strings. This vulnerability is particularly concerning because it can be exploited through the standard socket API, DNS se [truncated]
The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a single file-static net_buf_simple (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512 bytes) shared by all connection instances, while the BUSY flag, long-read handle, and reset/offset state were per-connection. When the device acts as a Broadcast Assistant conn [truncated]
