These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME case casts mgmt_tlv->data to a 10-byte struct ptp_timestamp and reads it (then byte-swaps and writes it back) without first checking that the TLV data field is at least sizeof(struct ptp_timestamp).
The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. This vulnerability can lead to out-of-bounds reads, potentially allowing an attacker to access sensitive information. Users of the Zephyr project, particularly those usin [truncated]
The LoRaWAN application-layer clock-synchronization service in the ZephyrProject Zephyr operating system has a vulnerability in the clock_sync_package_callback() function. This function is responsible for parsing downlinks in the clock synchronization service. The command loop only checks if the one-byte command id is within bounds, but for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command, it reads a 4-by [truncated]
The Sierra Wireless HL7800 cellular modem driver, used in various industries relying on cellular connectivity, has a stack buffer overflow vulnerability. This vulnerability, caused by the improper use of net_buf_linearize(), allows for a potential stack buffer overflow, which could lead to code execution in kernel context. The bug arises from writing a NUL terminator past the end of a 128-byte stack buffe [truncated]
The flash_copy() system call in Zephyr RTOS is vulnerable to local privilege escalation. A user-mode thread can cause the kernel to call arbitrary code in supervisor mode by supplying a pointer to a forged struct device whose api table contains attacker-chosen function pointers. This affects systems with CONFIG_USERSPACE enabled. The fix adds K_SYSCALL_DRIVER_FLASH(src_dev, read) and K_SYSCALL_DRIVER_FLAS [truncated]
An out-of-bounds read vulnerability exists in Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code, affecting the Zephyr operating system. The vulnerability is triggered by a crafted frame that can be sent by an unauthenticated attacker on the radio/adjacent link, causing a denial-of-service on the receiver. This issue arises from the get_ihpc_inlined_size() function, which fails to bounds-che [truncated]
The ARM PL011 UART driver fails to acknowledge receive error interrupts, leading to a denial-of-service condition. An attacker can inject line errors to cause an interrupt storm, making the system hang. This issue affects applications that enable error-interrupt reporting via uart_irq_err_enable() on PL011-based, interrupt-driven ports. The error interrupt is off by default and no in-tree subsystem enable [truncated]
The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events, leading to out-of-bounds stack disclosure and potential denial of service. This issue arises from the linearization of the response line into a fixed 40-byte stack buffer in the on_cmd_socknotifyev() function (drivers/modem/vendor_standalone/wncm14a2a.c). The response line is capped at 39 bytes, but the scanning loops are bounded [truncated]
The Zephyr dynamic kernel-object disposal path has a use-after-free vulnerability. When a dynamically-allocated, initialized, and armed k_timer is freed without cancelling its timeout, a dangling node remains in the global timeout queue. Upon timer expiration, the timeout machinery invokes z_timer_expiration_handler() on the freed node, causing a deterministic use-after-free that allows an unprivileged us [truncated]
A use-after-free vulnerability exists in the Zephyr second-generation work queue, specifically in the handling of delayable work timeouts. This issue allows for kernel memory corruption or crash, resulting in a denial of service. The vulnerability has a CVSS score of 5.8 and is classified as MEDIUM severity. The vulnerability is caused by a use-after-free error in the Zephyr second-generation work queue. [truncated]
The vulnerability exists in the user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c of the Zephyr Project's logging subsystem. This verifier was a pure pass-through, forwarding caller-supplied arguments directly to the kernel-mode implementation without performing mandatory K_SYSCALL_* checks. This allows an unprivileged user-mode thread to invoke a kernel-mode han [truncated]
A malicious or malfunctioning Bluetooth device can cause a denial-of-service attack on the Bluetooth subsystem by exploiting a vulnerability in the GATT client function, specifically in the parse_read_std_char_desc() function in subsys/bluetooth/host/gatt.c. The vulnerability occurs when the device initiates standard-descriptor-value discovery, allowing an unauthenticated adjacent attacker to trigger it. [truncated]
A local privilege escalation vulnerability was found in the userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in the Zephyr operating system. The vulnerability occurs due to a double-fetch issue in the handling of the msg_iovlen field, allowing a cooperating second thread to inflate the field and cause the population loop to write beyond the allocated kernel-heap shadow buffer. [truncated]
A memory corruption vulnerability exists in the Zephyr device_next USB stack's CDC NCM class control-to-host handler. The handler builds a fixed-size response for specific class requests and copies it into a control DATA IN buffer without validating the host-supplied wLength. This can cause an out-of-bounds write, leading to memory corruption and denial of service of the USB stack.
A use-after-free and double-free vulnerability exists in the Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send(), in the Zephyr operating system. The vulnerability occurs when the driver fails to follow the bt_hci_driver_api buffer-ownership contract, leading to a double-free corruption of the host net_buf pool and potential crashes. This issue can be triggered by a remote Bluetooth peer d [truncated]
The Zephyr ARM port's handling of the hardware FPU (CONFIG_FPU) and Floating point ABI (CONFIG_FP_HARDABI or CONFIG_FP_SOFTABI) can lead to information disclosure or cross-thread FP state corruption when CONFIG_FPU_SHARING is disabled. The compiler may emit hardware FP instructions in any function, but callee-saved FP registers are not saved and restored across context switches. This issue arises because, [truncated]
The CVE-2026-8718 vulnerability affects Zephyr's TLS/DTLS implementation, specifically in the tls_opt_dtls_peer_connection_id_value_get() function. This function did not verify the buffer size before passing it to mbedtls_ssl_get_peer_cid(), causing potential buffer overflows. The vulnerability has a CVSS score of 8.4 and is classified as HIGH severity. It requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, a [truncated]
A local actor can invoke update operations and win a timing race against the background handler to trigger a denial of service of the firmware-update path due to corruption of the update subsystem's internal state. The issue is caused by unsynchronized sharing of the ctx structure, allowing two flows to interleave connection setup and teardown, double-closing a socket descriptor or scribbling the shared buffers.
A use-after-free vulnerability exists in the Zephyr kernel's queue helper function `z_queue_node_peek()`. This function, used by `z_impl_k_queue_peek_head()` and `z_impl_k_queue_peek_tail()`, can lead to stale or dangling pointers being returned when used concurrently with `k_queue_get()` on the same queue. This issue affects various subsystems including net_buf, Bluetooth, USB, and networking. The vulner [truncated]
The hawkBit device management client in subsys/mgmt/hawkbit is vulnerable to a heap-based out-of-bounds write, which could lead to denial of service via heap corruption. This issue arises from the accumulation of HTTP response bodies into a heap buffer without reserving space for a terminating NUL. The vulnerability is remotely reachable as the body length and fragmentation are controlled by the remote ha [truncated]
A remotely triggerable denial of service vulnerability exists in the OCPP 1.6 client in subsys/net/lib/ocpp due to improper parsing of inbound WAMP RPC frames. The issue arises from the use of strncpy and strchr functions that can lead to out-of-bounds access and potential corruption of adjacent stack state. This vulnerability affects systems with the EXPERIMENTAL feature CONFIG_OCPP enabled. Users should [truncated]
Zephyr's Bluetooth Mesh implementation has a vulnerability (CVE-2026-10774) that causes an imbalance in PSA Crypto key slots used for subnet keys. When CONFIG_BT_MESH_PRIV_BEACONS is enabled, a key slot is imported but not properly released due to a mismatch in configuration guards. This leads to a gradual exhaustion of the PSA key slot pool, affecting not only Bluetooth Mesh functionality but also other [truncated]
Zephyr's Bluetooth host incorrectly evaluates the security permissions of a GATT characteristic's declaration attribute instead of its value attribute, potentially leading to information disclosure or access-control bypass. The issue arises when an application passes the Characteristic Declaration attribute to the public notify and indicate APIs, causing the host to skip the encryption/authentication/LESC [truncated]
Zephyr's IPv6 forwarding path re-sent routed unicast packets without decrementing the IPv6 hop limit, allowing an on-path attacker to induce a permanent forwarding storm, causing CPU/bandwidth resource exhaustion on the forwarder and adjacent links. This vulnerability was introduced in v1.8.0 and affected releases up to v4.4.1. The issue was fixed on main by 7d8f1afa7345 and 589eadc74efa. Users of Zephyr [truncated]
A denial-of-service vulnerability exists in the Synopsys DesignWare I2C driver operating in target/slave mode. An I2C master on the same physical bus can trigger this vulnerability, causing the I2C target function to malfunction for all subsequent write transactions. This issue arises from the rx_full interrupt handler gating the write_requested() callback on dw->state != CMD_SEND, and dw->state is only r [truncated]
The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative value for src_id (e.g. -1) trivially satisfied this check and was forwarded into z_impl_log_filter_set, where it propagated to filter_set() and ultimately to get_dynamic_filt [truncated]
A medium-severity vulnerability was found in Zephyr's userspace dynamic-objects subsystem. The flaw, CVE-2026-10681, allows two user-mode threads to alias a single bit position in every kernel object's perms[] bitfield, defeating userspace ACL isolation. This issue is reachable from any user-mode thread via the unrestricted __syscall k_object_alloc and is gated on CONFIG_USERSPACE, CONFIG_DYNAMIC_OBJECTS, [truncated]
The Zephyr ext2 file system has a division by zero vulnerability. The ext2_verify_disk_superblock() function does not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. An attacker who can present a crafted ext2 image can trigger this, causing a denial of service on ARMv7-M / ARMv8-M-mainline Cortex-M targets. The vulnerability is triggered when the ext2 file system is [truncated]
CVE-2026-10680 is a high-severity vulnerability in the Zephyr Bluetooth Classic (BR/EDR) L2CAP signaling handlers. The vulnerability arises from incorrect validation of command sizes, allowing an attacker to trigger an out-of-bounds read and write, leading to memory corruption and denial of service. This flaw is particularly concerning because it can be exploited by an unauthenticated peer within radio ra [truncated]
The MCTP-over-I2C+GPIO target binding in Zephyr contains a vulnerability that allows for memory corruption or denial of service. The issue arises from the processing of pseudo-register writes from an I2C bus master byte-by-byte without validating the order or the receive buffer. This vulnerability was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0, and it can [truncated]