These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-10670 vulnerability affects the Zephyr Project, specifically the k_thread_name_copy() system call verifier. This verifier does not properly check the return value of k_object_find() for NULL before dereferencing it, allowing an unprivileged user-mode thread to trigger a kernel-mode fault. This leads to a system halt or reboot. The flaw exists in builds with CONFIG_USERSPACE and CONFIG_THREAD_ [truncated]
The CVE-2026-10665 vulnerability is an out-of-bounds write issue in the Zephyr WireGuard subsystem. The `wg_process_data_message()` function in `wg_crypto.c` linearizes an inbound transport-data payload into a fixed pool buffer without properly checking the length, leading to a potential buffer overflow. This vulnerability can be exploited by a malicious or compromised peer over the network, resulting in [truncated]
The nRF70 Wi-Fi driver's power-save event handler has an out-of-bounds write vulnerability when handling TWT flow entries. This issue affects builds with CONFIG_NRF70_STA_MODE on releases through v4.4.0. The vulnerability arises from the handler copying TWT flow entries from an nrf_wifi_umac_event_power_save_info event into a fixed-size array without validating the number of entries, leading to a potentia [truncated]
CVE-2026-10663 is a use-after-free vulnerability in Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK). The vulnerability occurs because the usbh_device_disconnect() function in subsys/usb/host/usbh_device.c frees the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() in subsys/usb/host/usbh_core.c then uses this dangling poin [truncated]
A low-severity denial of service vulnerability exists in Zephyr's DNS resolver. The vulnerability occurs when the DNS resolver detects mDNS (.local) queries and performs a fixed-length comparison that can read beyond the string's NUL terminator, potentially causing a fault when the hostname's final label is shorter than 7 bytes. This can happen when the resolved hostname's final label is shorter than 7 by [truncated]
The MAX32xxx USB device controller driver in Zephyr versions prior to the patched version, specifically v4.4.0, contains a vulnerability where it dereferences an endpoint buffer without checking for NULL. This oversight leads to a denial-of-service (device crash) when a USB host aborts an in-flight EP0 control transfer with a new SETUP packet. The crash occurs because the driver processes a stale XFER_OUT [truncated]
A use-after-free race condition exists in the Zephyr asynchronous SNTP client when closing a socket while the socket service is still polling it. This issue can lead to a use-after-free / object confusion of kernel poll structures. The vulnerability is caused by the SNTP client closing the UDP socket file descriptor directly from the calling thread immediately after detaching it from the network socket se [truncated]
A race condition in the Zephyr Bluetooth Classic RFCOMM host stack mishandles a simultaneous bidirectional session disconnect, potentially leading to a denial of further RFCOMM service. This vulnerability affects Zephyr Bluetooth Classic deployments and requires defenders to assess exposure and apply patches. The issue arises from a flawed handling of session disconnections, which can lead to a denial of [truncated]
The Zephyr net_buf library incorrectly manipulated reference counts with non-atomic operators, leading to potential double-free and use-after-free vulnerabilities. This issue affects all Zephyr releases through v4.4.0 and is gated on genuine concurrency and specific application architecture. The fix converts both refcounts to atomic_inc/atomic_dec. Users should review and apply patches or implement serial [truncated]
The Zephyr Bluetooth controller ISO Adaptation Layer (ISOAL) fails to validate the length field of a framed ISO PDU start segment, leading to an out-of-bounds read that leaks adjacent memory into host HCI ISO packets. This issue allows a remote CIS peer or broadcaster to trigger information disclosure. The vulnerability affects Zephyr-based systems using Bluetooth functionality, particularly those with ex [truncated]
CVE-2026-10652 is a medium-severity vulnerability in Zephyr's DNS resolver. The vulnerability occurs in the dns_unpack_answer() function, which fails to validate the rdlength field of DNS resource records, leading to an out-of-bounds read. This issue allows an attacker to leak sensitive information and potentially cause a denial of service. Affected product deployments should be identified, and owners ass [truncated]
A NULL-pointer dereference vulnerability exists in the MCUmgr serial/console SMP transport of Zephyr, which can be exploited by an attacker on the serial/console link to crash the device, resulting in a denial of service. The vulnerability is caused by a faulty NULL check in the `mcumgr_serial_process_frag` function, which calls `net_buf_reset` on a potentially NULL pointer. This can occur when the shared [truncated]
CVE-2026-8023 is a high-severity vulnerability in Zephyr's HTTP server that allows unauthenticated remote clients to read arbitrary files on the mounted volume. The vulnerability exists in the static-filesystem resource type, which serves files from a configured root directory. An attacker can exploit this vulnerability by sending a specially crafted request that traverses the directory structure, allowin [truncated]
The IPv6 Neighbor Discovery handlers in Zephyr's subsys/net/ip/ipv6_nbr.c contained an incorrect boolean expression that combined RFC 4861 validity checks with the ICMPv6 code check using wrong operator precedence. This allowed an attacker to bypass checks, including the mandatory Hop Limit == 255 verification and source address checks for Router Advertisements. As a result, an adjacent on-link attacker — [truncated]
A deadlock vulnerability exists in the Zephyr project's USB CDC-NCM device class implementation. When the `usbd_ep_enqueue()` function fails, the `cdc_ncm_send()` function still calls `k_sem_take(&data->sync_sem, K_FOREVER)`, blocking on a completion semaphore that is only signaled from the bulk-IN transfer-completion callback. This can occur when the bus is suspended or disconnected, causing a permanent [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-28T05:16:21.083Z and has not been modified since then. The NVD entry is currently Modified. The CVE-2026-10646 vulnerability in Zephyr's BSD-sockets getaddrinfo() implementation allows for a network-influenceable use-after-return, potentially leading to crashes or memory corruption. This occurs when [truncated]
The Microchip SERCOM-G1 UART driver, used by the PIC32CM-JH SoC family in the Zephyr project, contains an out-of-bounds write in its asynchronous receive path. This issue occurs when a one-byte receive buffer is used with the async UART configuration enabled. The defect was introduced in version 4.4.0 and has been fixed in version 4.4.2. The impact is limited to single-byte memory corruption adjacent to t [truncated]
A NULL-pointer dereference vulnerability exists in the Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client. A malicious or buggy remote ASCS server can trigger a crash (denial of service) by sending a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state.
The CVE-2026-10643 vulnerability in Zephyr's IP socket recvmsg() implementation allows for a fixed-size out-of-bounds write of up to one cmsg header past the end of the buffer. This occurs when the user-supplied ancillary buffer is validated using only the payload length, omitting the cmsg header size. The issue is reachable on a UDP/IP socket with IP_PKTINFO/IPV6_RECVPKTINFO enabled when recvmsg() is cal [truncated]
The Zephyr PL011 UART driver contains an unbounded software loop in pl011_irq_tx_enable() that can cause a denial of service. The vulnerability was introduced in commit b783bc8448ef (Feb 2025) and shipped in releases v4.1.0 through v4.4.0. An attacker controlling the device attached to the UART's CTS line can trigger the hang. The impact is availability only, with no memory-safety, confidentiality, or int [truncated]
Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser contains an out-of-bounds write vulnerability. During Service Level Connection setup, a remote Attendant Gateway can send a malformed AT response with more than 20 recognized indicator entries, causing memory corruption and denial of service of the Bluetooth host. This issue affects builds with CONFIG_BT_HFP_HF enabled and was intr [truncated]
CVE-2026-10640 is a MEDIUM severity vulnerability in Zephyr's IPv6 Neighbor Discovery send paths. The vulnerability is caused by a use-after-free issue when updating per-interface ICMP-sent statistics. This can lead to corrupted statistics, denial of service, or potential limited memory corruption. The vulnerability is reachable by any unauthenticated on-link node simply by sending ICMPv6 Neighbor Solicit [truncated]
CVE-2026-10639 is a use-after-free vulnerability in Zephyr's native IPv4 stack. The vulnerability occurs when the `icmpv4_handle_echo_request` function builds an echo-reply packet, hands it to `net_try_send_data()`, and then, on success, calls `net_stats_update_icmp_sent(net_pkt_iface(reply))`. The `net_try_send_data()` function transfers ownership of the reply packet to the TX path, which can unref it to [truncated]
CVE-2026-10638 is a medium-severity denial of service vulnerability in Zephyr's networking stack. The vulnerability exists in the ICMPv6 implementation, specifically in the handling of Echo Request (ping) and error responses. When an ICMPv6 packet is sent, the code attempts to access the network interface from the packet after it has been freed, leading to a use-after-free read and potential write through [truncated]
CVE-2026-10637 is a remotely triggerable denial of service vulnerability in the Zephyr networking stack. The vulnerability exists in the `mld_send()` function, which reads the packet interface after `net_send_data(pkt)` has returned successfully. This is problematic because `net_send_data(pkt)` transfers ownership of the `net_pkt` to the L2 driver, which frees it upon success. As a result, the subsequent [truncated]
CVE-2026-10635 is a medium-severity vulnerability in the Zephyr kernel, affecting Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU. The vulnerability arises from the page-table code maintaining a global list of active memory domains. When a domain is destroyed, its node is not removed from the list, leading to a dangling pointer. This can cause a NULL pointer dereference or, if the memory has be [truncated]
A use-after-free vulnerability in Zephyr's native TCP stack can cause a denial of service and potentially information disclosure. The vulnerability is triggered when a concurrent tcp_conn_release() removes and frees the cached next connection while iterating the global connection list in net_tcp_foreach(). This issue affects Zephyr-based systems using the native TCP stack, particularly those with exposure [truncated]
