These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A medium-severity vulnerability was found in Zephyr's userspace dynamic-objects subsystem. The flaw, CVE-2026-10681, allows two user-mode threads to alias a single bit position in every kernel object's perms[] bitfield, defeating userspace ACL isolation. This issue is reachable from any user-mode thread via the unrestricted __syscall k_object_alloc and is gated on CONFIG_USERSPACE, CONFIG_DYNAMIC_OBJECTS, [truncated]
The Zephyr ext2 file system has a division by zero vulnerability. The ext2_verify_disk_superblock() function does not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. An attacker who can present a crafted ext2 image can trigger this, causing a denial of service on ARMv7-M / ARMv8-M-mainline Cortex-M targets. The vulnerability is triggered when the ext2 file system is [truncated]
CVE-2026-10680 is a high-severity vulnerability in the Zephyr Bluetooth Classic (BR/EDR) L2CAP signaling handlers. The vulnerability arises from incorrect validation of command sizes, allowing an attacker to trigger an out-of-bounds read and write, leading to memory corruption and denial of service. This flaw is particularly concerning because it can be exploited by an unauthenticated peer within radio ra [truncated]
The MCTP-over-I2C+GPIO target binding in Zephyr contains a vulnerability that allows for memory corruption or denial of service. The issue arises from the processing of pseudo-register writes from an I2C bus master byte-by-byte without validating the order or the receive buffer. This vulnerability was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0, and it can [truncated]
A medium-severity vulnerability, CVE-2026-10677, was found in the Zephyr kernel's CONFIG_USERSPACE syscall verifier z_vrfy_k_poll(). The vulnerability allows a user thread to pass a forged object handle, leading to a kernel memory leak. This leak can be repeated by spawning sacrificial threads until the shared kernel heap is exhausted, causing legitimate kernel allocations to fail and resulting in a syste [truncated]
CVE-2026-10675 is a denial of service vulnerability in Zephyr's Bluetooth Mesh PB-ADV provisioning bearer. A remote, unauthenticated attacker can induce a persistent denial of provisioning/re-provisioning service by exploiting this vulnerability. The vulnerability exists because the provisioning protocol watchdog timer is rescheduled unconditionally at the top of the prov_msg_recv() function, before the F [truncated]
The CVE-2026-10665 vulnerability is an out-of-bounds write issue in the Zephyr WireGuard subsystem. The `wg_process_data_message()` function in `wg_crypto.c` linearizes an inbound transport-data payload into a fixed pool buffer without properly checking the length, leading to a potential buffer overflow. This vulnerability can be exploited by a malicious or compromised peer over the network, resulting in [truncated]
The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() has an out-of-bounds write vulnerability. This occurs when the handler copies TWT flow entries from an nrf_wifi_umac_event_power_save_info event into a fixed-size array without validating the number of entries, leading to a potential buffer overflow. The vulnerability is triggered when the number of TWT flow entrie [truncated]
CVE-2026-10663 is a use-after-free vulnerability in Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK). The vulnerability occurs because the usbh_device_disconnect() function in subsys/usb/host/usbh_device.c frees the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() in subsys/usb/host/usbh_core.c then uses this dangling poin [truncated]
A low-severity denial of service vulnerability exists in Zephyr's DNS resolver. The vulnerability occurs when the DNS resolver detects mDNS (.local) queries and performs a fixed-length comparison that can read beyond the string's NUL terminator, potentially causing a fault when the hostname's final label is shorter than 7 bytes. This can happen when the resolved hostname's final label is shorter than 7 by [truncated]
The MAX32xxx USB device controller driver in Zephyr versions prior to the patched version, specifically v4.4.0, contains a vulnerability where it dereferences an endpoint buffer without checking for NULL. This oversight leads to a denial-of-service (device crash) when a USB host aborts an in-flight EP0 control transfer with a new SETUP packet. The crash occurs because the driver processes a stale XFER_OUT [truncated]
CVE-2026-10652 is a medium-severity vulnerability in Zephyr's DNS resolver. The vulnerability occurs in the dns_unpack_answer() function, which fails to validate the rdlength field of DNS resource records, leading to an out-of-bounds read. This issue allows an attacker to leak sensitive information and potentially cause a denial of service. Affected product deployments should be identified, and owners ass [truncated]
CVE-2026-8023 is a high-severity vulnerability in Zephyr's HTTP server that allows unauthenticated remote clients to read arbitrary files on the mounted volume. The vulnerability exists in the static-filesystem resource type, which serves files from a configured root directory. An attacker can exploit this vulnerability by sending a specially crafted request that traverses the directory structure, allowin [truncated]
The IPv6 Neighbor Discovery handlers in Zephyr's subsys/net/ip/ipv6_nbr.c contained an incorrect boolean expression that combined RFC 4861 validity checks with the ICMPv6 code check using wrong operator precedence. This allowed an attacker to bypass checks, including the mandatory Hop Limit == 255 verification and source address checks for Router Advertisements. As a result, an adjacent on-link attacker — [truncated]
The Zephyr PL011 UART driver contains an unbounded software loop in pl011_irq_tx_enable() that can cause a denial of service. The vulnerability was introduced in commit b783bc8448ef (Feb 2025) and shipped in releases v4.1.0 through v4.4.0. An attacker controlling the device attached to the UART's CTS line can trigger the hang. The impact is availability only, with no memory-safety, confidentiality, or int [truncated]
Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser contains an out-of-bounds write vulnerability. During Service Level Connection setup, a remote Attendant Gateway can send a malformed AT response with more than 20 recognized indicator entries, causing memory corruption and denial of service of the Bluetooth host. This issue affects builds with CONFIG_BT_HFP_HF enabled and was intr [truncated]
CVE-2026-10640 is a MEDIUM severity vulnerability in Zephyr's IPv6 Neighbor Discovery send paths. The vulnerability is caused by a use-after-free issue when updating per-interface ICMP-sent statistics. This can lead to corrupted statistics, denial of service, or potential limited memory corruption. The vulnerability is reachable by any unauthenticated on-link node simply by sending ICMPv6 Neighbor Solicit [truncated]
CVE-2026-10639 is a use-after-free vulnerability in Zephyr's native IPv4 stack. The vulnerability occurs when the `icmpv4_handle_echo_request` function builds an echo-reply packet, hands it to `net_try_send_data()`, and then, on success, calls `net_stats_update_icmp_sent(net_pkt_iface(reply))`. The `net_try_send_data()` function transfers ownership of the reply packet to the TX path, which can unref it to [truncated]
CVE-2026-10638 is a medium-severity denial of service vulnerability in Zephyr's networking stack. The vulnerability exists in the ICMPv6 implementation, specifically in the handling of Echo Request (ping) and error responses. When an ICMPv6 packet is sent, the code attempts to access the network interface from the packet after it has been freed, leading to a use-after-free read and potential write through [truncated]
CVE-2026-10637 is a remotely triggerable denial of service vulnerability in the Zephyr networking stack. The vulnerability exists in the `mld_send()` function, which reads the packet interface after `net_send_data(pkt)` has returned successfully. This is problematic because `net_send_data(pkt)` transfers ownership of the `net_pkt` to the L2 driver, which frees it upon success. As a result, the subsequent [truncated]
CVE-2026-10635 is a medium-severity vulnerability in the Zephyr kernel, affecting Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU. The vulnerability arises from the page-table code maintaining a global list of active memory domains. When a domain is destroyed, its node is not removed from the list, leading to a dangling pointer. This can cause a NULL pointer dereference or, if the memory has be [truncated]
CVE-2026-10634 is a medium-severity vulnerability in Zephyr's native TCP stack. The vulnerability occurs in the `net_tcp_foreach()` function, which iterates over the global connection list. The function releases the `tcp_lock` while invoking a per-connection callback and re-acquires it afterwards. During this window, a concurrent `tcp_conn_release()` can remove and free the cached next connection, leading [truncated]
