These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-75085 vulnerability is an out-of-bounds read issue in the STM32WBA IEEE 802.15.4 driver. It occurs when the driver incorrectly calculates the packet length of a received frame, leading to a potential buffer overflow. This vulnerability has a CVSS score of 4.2 and is classified as MEDIUM severity. The issue arises from the driver's failure to validate the received frame length, which can be in [truncated]
An out-of-bounds write vulnerability exists in the TI CC1200 IEEE 802.15.4 driver due to an unvalidated radio-supplied packet length. This issue allows an unauthenticated attacker within radio range to transmit a frame with a length byte above the IEEE 802.15.4 maximum of 127, potentially causing a buffer overflow. The vulnerability arises from the driver's failure to properly validate the packet length b [truncated]
A vulnerability in Zephyr's Ethernet L2 implementation can cause an out-of-bounds read and net_buf length underflow when parsing a truncated VLAN header. This issue arises when the `ethernet_recv()` function in `ethernet.c` fails to properly validate the length of received frames, particularly when the frame's ethertype is 0x8100 and VLAN is enabled. An unauthenticated attacker can trigger this vulnerabil [truncated]
Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver. The vulnerability occurs in the receive path of the driver, specifically in the kw41z_rx() function in drivers/ieee802154/ieee802154_kw41z.c. The interrupt handler kw41z_isr() obtains the frame length from the RX_FRAME_LENGTH field of the ZLL IRQSTS register, which is a copy of the PHY [truncated]
The Zephyr software Bluetooth LE Controller has a vulnerability in its Link Layer Control Procedure (LLCP) implementation, which retains a receive node that carried an accepted LL_PHY_UPDATE_IND. This can lead to a retained RX node leak and reachable assertion in the PHY Update procedure. Bluetooth LE device manufacturers and users, especially those using Zephyr software, should be aware of this vulnerabi [truncated]
Bluetooth devices using Zephyr's Bluetooth Link Layer control procedure are vulnerable to a remotely triggerable denial-of-service attack. An unauthenticated peer can send a crafted LL_CONNECTION_UPDATE_IND or LL_CONNECTION_PARAM_REQ, followed by another LL Control PDU, to cause a controller crash or leak a node from the RX pool, leading to a persistent denial-of-service condition until reboot.
A Bluetooth Link Layer Control Procedure (LLCP) implementation vulnerability in Zephyr's Connected Isochronous Stream (CIS) creation allows a peer device within radio range to cause a controller fatal error and system reset by sending a single extra LL Control PDU on an unauthenticated, unencrypted ACL link. The issue arises from the LLCP implementation retaining an RX node without releasing it under cert [truncated]
A remote, unauthenticated peer can trigger a use-after-free vulnerability in the Zephyr Bluetooth LE host by sending a data K-frame immediately followed by an L2CAP Disconnect Request. This allows the system workqueue to hold a reference to the channel object after it has been freed or reallocated, potentially leading to a crash or corruption of the workqueue's pending list.
A denial-of-service vulnerability exists in the Zephyr i2s_esp32_trigger_check() function. The function does not validate the requested direction for I2S_DIR_RX and I2S_DIR_TX, leading to a potential system halt. This issue arises from missing pointer checks, which can cause a load from address 0 in kernel mode. The vulnerability impacts availability, with no attacker-controlled offset, write primitive, o [truncated]
A vulnerability in the zbus proxy agent IPC backend in Zephyr's subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c allows a peer domain to trigger a log message with a non-terminated buffer, potentially disclosing a small amount of adjacent memory into the receiving domain's log sink. The vulnerability arises from the logging of the channel name of a rejected inter-domain frame with a plain %s conversion, whi [truncated]
The NXP MCUX TRNG entropy driver in Zephyr's drivers/entropy/entropy_mcux_trng.c contains a vulnerability that allows an attacker to cause memory corruption of up to 127 bytes immediately following the supplied buffer. This occurs when the TRNG_GetRandomData() function is called with a length that is not a multiple of four, causing the SDK to write beyond the end of the buffer.
A vulnerability in the Zephyr project's TCP Initial Sequence Number (ISN) generation implementation can lead to predictable ISNs, allowing for blind TCP connection spoofing and data injection attacks. This occurs when the cryptographic random source fails, causing the unique key used for ISN generation to become all-zero, making ISNs predictable. Network administrators and security teams should assess exp [truncated]
An out-of-bounds read vulnerability exists in the Zephyr project's IPv6 neighbor cache implementation. When an unauthenticated attacker on the same link sends a packet to a spoofed, non-existent neighbor address, it can force the unresolved state and cause an out-of-bounds read at a fixed index past the neighbor link-layer address array. This can lead to a denial of service or disclosure of unrelated static RAM.
CVE-2026-19576 is a stack overflow vulnerability in the Goodix GT9xx input driver. The vulnerability is triggered by a controller reporting more points than the array holds, causing up to 112 bytes of peer-supplied data to be written past the end of the array. This can lead to a potential control-flow hijack on the host MCU. Defenders responsible for securing devices using this driver should assess exposu [truncated]
CVE-2026-19669 is a high-severity vulnerability in the Zephyr operating system's fuel gauge syscall handlers. An out-of-bounds write in supervisor mode allows attacker-controlled length and content, leading to kernel code execution or a system crash. The vulnerability is caused by unvalidated user input in the fuel_gauge_get_props() and fuel_gauge_set_props() syscalls. Affected Zephyr developers, users, a [truncated]
A buffer overflow vulnerability exists in the Bluetooth Mesh On-Demand Private Proxy solicitation handler in Zephyr's subsys/bluetooth/mesh/solicitation.c. The vulnerability occurs when a received Solicitation PDU is copied into a fixed 17-byte stack buffer without bounding the source length, allowing an attacker to write past the buffer's end. This can be triggered by an oversized advertisement, potentia [truncated]
Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write operations. This vulnerability, identified as CVE-2026-19186, affects Zephyr-based systems using IEEE 802.15.4 frame decryption. The issue arises from the ieee802154_decipher_data_frame() function in subsys/net/l2/ieee802154/ieee802154_frame.c, which does not check if the received frame is at least ll_hdr_len + autht [truncated]
CVE-2026-18416 is a vulnerability in the CoAP link-format helper match_path_uri() in Zephyr's subsys/net/lib/coap/coap_link_format.c. The vulnerability occurs when comparing a registered resource path against a URI carried in a Uri-Query href= option. The URI is not NUL terminated, and the inner character loop advances its index without testing it against the option length, potentially reading past the en [truncated]
An out-of-bounds write vulnerability exists in the ieee802154_send() function of Zephyr's IEEE 802.15.4 subsystem. The function copies an outgoing packet into a fixed 125-byte transmit buffer without proper length validation, allowing an attacker to overflow the buffer and corrupt adjacent memory. This can lead to a crash or further compromise of kernel state.
The ADI MAX32 driver in the Zephyr ADC API did not properly validate the buffer size for sampling sequences, allowing for a buffer overflow and potential kernel-memory corruption. This vulnerability can be exploited by an unprivileged user-mode thread, potentially leading to privilege escalation and denial-of-service attacks. Defenders responsible for Zephyr-based systems, particularly those with unprivil [truncated]
The ITE it51xxx I2C driver has a buffer overflow vulnerability when operating as an I2C target in buffer mode. A malicious or misbehaving I2C master can trigger an out-of-bounds write, potentially crashing the controller or leading to code execution. This issue requires prompt attention from defenders to prevent potential crashes or code execution. Affected deployments should prioritize patching or implem [truncated]
The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME case casts mgmt_tlv->data to a 10-byte struct ptp_timestamp and reads it (then byte-swaps and writes it back) without first checking that the TLV data field is at least sizeof(struct ptp_timestamp).
The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. This vulnerability can lead to out-of-bounds reads, potentially allowing an attacker to access sensitive information. Users of the Zephyr project, particularly those usin [truncated]
The LoRaWAN application-layer clock-synchronization service in the ZephyrProject Zephyr operating system has a vulnerability in the clock_sync_package_callback() function. This function is responsible for parsing downlinks in the clock synchronization service. The command loop only checks if the one-byte command id is within bounds, but for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command, it reads a 4-by [truncated]
The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem, allowing an attacker to present a crafted ext2 image that can cause a supervisor-mode memory-corruption primitive, potentially leading to denial of service or code execution. The vulnerability is gated only by data read from the mounted image, making it reachable by any atta [truncated]
A remotely triggerable denial-of-service vulnerability exists in the Hearing Access Service (HAS) GATT server implementation in Zephyr RTOS. An attacker who has previously bonded with the device can trigger a crash by reconnecting within a specific time window before the application registers the service. This issue affects Bluetooth device manufacturers and developers who use the Zephyr RTOS and have imp [truncated]
The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. This causes an out-of-bounds read of a {function pointer, argument} pair from heap memory, leading to an arbitrary / attacker-influenced function-pointer call in the Zephyr guest, i.e., a control-flow-hijack primitive that can lead to code execution or a reliable crash.
A buffer leak vulnerability exists in the Infineon Airoc Wi-Fi driver's transmit callback, which can lead to a denial-of-service (DoS) condition. The vulnerability occurs when the driver fails to release a buffer in case of a synchronous send failure. This can be triggered by a Wi-Fi-adjacent attacker influencing the conditions that cause synchronous send failures. The impact is availability-only, and the [truncated]
The Sierra Wireless HL7800 cellular modem driver, used in various industries relying on cellular connectivity, has a stack buffer overflow vulnerability. This vulnerability, caused by the improper use of net_buf_linearize(), allows for a potential stack buffer overflow, which could lead to code execution in kernel context. The bug arises from writing a NUL terminator past the end of a 128-byte stack buffe [truncated]
The flash_copy() system call in Zephyr RTOS is vulnerable to local privilege escalation. A user-mode thread can cause the kernel to call arbitrary code in supervisor mode by supplying a pointer to a forged struct device whose api table contains attacker-chosen function pointers. This affects systems with CONFIG_USERSPACE enabled. The fix adds K_SYSCALL_DRIVER_FLASH(src_dev, read) and K_SYSCALL_DRIVER_FLAS [truncated]
