Zephyrproject
Monthly
Bluetooth Object Transfer Service (OTS) servers in Zephyr (>= 3.3.0 through <= 4.4.2) mishandle failed Calculate Checksum responses: oacp_ind_send() appends a four-byte Checksum Value field based only on the requested op code, then calls net_buf_simple_pull_le32() on a zero-length stack buffer whenever validation failed. Any peer within radio range can abuse this with a nine-byte OACP write and no pairing, encryption or authentication, because the OACP characteristic and its CCC are exposed with unauthenticated write permissions. On CONFIG_ASSERT builds the zero-length pull trips the assertion in net_buf_simple_pull_mem() and panics the device (remote DoS); with assertions compiled out the same path copies four bytes of uninitialized stack memory into the indication sent to the peer, repeatable per request and bounded to four bytes with no memory corruption; the reporter's reproducer demonstrates the panic and no public exploit tooling beyond it is confirmed.
An out-of-bounds write in Zephyr's USB device_next Bluetooth HCI transport class (subsys/usb/device_next/class/bt_hci.c) allows memory adjacent to a statically allocated USB transfer pool to be overwritten with attacker-influenced bytes. Zephyr releases from 3.3.0 through 4.4.2 are affected via the CPE cpe:2.3:a:zephyrproject:zephyr, with the remotely reachable triggers applying to full-speed-only builds from v4.2.0 onward where the endpoint pool slot is 64 bytes; an attacker within Bluetooth range needs no authentication and no user interaction, and in the stock full-speed-only configuration the mandatory 70-byte Read Supported Commands event already overruns the slot by six bytes during ordinary host initialization. Silent corruption with potential code execution requires CONFIG_ASSERT=n and no memory protection between subsystems, while assertion-enabled builds panic instead, giving a remotely triggerable denial of service. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the vendor fix is merged upstream but the release containing it is projected rather than shipped.
Stale arm64 TLB entries in Zephyr RTOS 4.3.0 through 4.4.2 let an unprivileged user thread (CVSS PR:L, local access) retain read/write mappings to a physical page frame after the demand paging eviction algorithm has reclaimed and reissued that frame to the kernel or to another memory domain. Because the single-VA invalidation only ever matched ASID 0 and global entries, a domain-private non-global leaf created for a k_mem_partition or a user thread stack survives page-out, enabling information disclosure and memory corruption that breaks CONFIG_USERSPACE isolation with scope-changing impact beyond the vulnerable component. Exploitation requires an arm64 build with both CONFIG_USERSPACE and the experimental CONFIG_DEMAND_PAGING enabled, an active backing store, and a demand-paged page privately mapped into a user memory domain; the attacker must already be running user-mode code and must drive memory pressure to force eviction and immediate frame reuse (AC:H). No public exploit code or PoC reference was identified in the available sources and the issue is not listed in CISA KEV; vendor fix commits are merged upstream on main with a projected fixed version of 4.5.0, while branch backports remain open.
WireGuard in Zephyr (subsys/net/lib/wireguard) accepts an unauthenticated transport-data datagram and copies its source address into peer->endpoint, letting any host that can reach the listener's UDP port 51820 off-path redirect all subsequent handshake initiations, keepalives and encrypted tunnel traffic to an address of the attacker's choosing. Affected builds are Zephyr 4.4.0 through 4.4.2 with CONFIG_WIREGUARD enabled, which is marked experimental and off by default, and the defect fires only while the targeted peer has no valid handshake and no current keypair - the state at boot and after a session expires. The result is persistent tunnel denial (assessed A:H) and limited confidentiality loss (C:L) through traffic-metadata observation or selective dropping if the attacker relays redirected initiations; the Noise/AEAD cryptography prevents decryption or forgery, so keys are not compromised. The advisory's original report includes a 16-byte datagram recipe as a proof of concept; it is not verified as working exploit code, no public exploit is confirmed in use, and KEV status is not indicated - exploitation requires only UDP reachability to the listener, with no credentials or user interaction.
Zephyr's OpenThread joiner autostart can cause an uncommissioned device to join an attacker-controlled Thread mesh because the build defaulted to the public Joining Device Credential 'J01NME'. Builds with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that leave CONFIG_OPENTHREAD_JOINER_PSKD unset are affected, and an attacker within 802.15.4 radio range running a commissioner with that same PSKd can complete commissioning and supply an arbitrary operational dataset. A reporter-supplied PoC reference exists but is not independently verified as working exploit code; joiner autostart is not enabled by default and no in-tree Zephyr sample uses the vulnerable combination.
A stale-state flaw in Zephyr's experimental MCTP-over-I2C+GPIO target binding lets any device that can act as an I2C controller on the shared management bus crash the target with two ordinary transactions, because the selected pseudo-register and data-phase flag are never reset at STOP. The resulting NULL pointer dereference occurs inside the I2C target interrupt handler, so on parts that trap address-0 accesses it produces a fatal exception and device reset or halt; on other parts it degrades to a malformed packet buffer reaching the MCTP stack and silently dropped transmit packets. Only builds with CONFIG_MCTP and CONFIG_MCTP_I2C_GPIO_TARGET=y are exposed, exploitation requires a pre-existing foothold on the same physical bus (compromised peer endpoint or BMC), and no public exploit code was identified at time of analysis; the authoritative assessment scores this as availability-only impact (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the C:L/I:N variant in the published vector.
Missing scheduler-lock protection in Zephyr RTOS's z_waitq_head() helper lets a local unprivileged user-mode thread race the kernel timer expiration handler against thread abort on multi-core builds, yielding use-after-free and out-of-bounds writes performed in supervisor context along with scheduler state corruption; the more common outcome of a lost race is a kernel crash rather than controlled corruption. Only builds with CONFIG_MP_MAX_NUM_CPUS greater than one and CONFIG_USERSPACE enabled are exposed, since the affected code path is a no-op on uniprocessor targets and the required k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() primitives are syscalls. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and the narrow timing window keeps practical risk conditional rather than drive-by.
User-mode-to-kernel escape in Zephyr RTOS lets a local thread that holds a granted PECI device object turn peci_transfer() into arbitrary supervisor-mode read and write primitives. The syscall verifier z_vrfy_peci_transfer() validated only the outer struct peci_msg and then handed the caller-controlled tx_buffer/rx_buffer pointers and lengths to in-tree drivers (NPCX, IT8xxx2, MCHP XEC), which dereference them in supervisor mode - allowing kernel memory to be overwritten with hardware-supplied bytes, kernel contents to be pushed onto the PECI/eSPI bus, or a supervisor fault via an unmapped address. Scoring is CVSS 3.1 7.8 (AV:L/PR:L, C:H/I:H/A:H) and exploitation is gated on CONFIG_USERSPACE=y, an enabled vulnerable PECI driver, and local code execution in a thread already granted the PECI device; no public exploit code exists at time of analysis and there is no confirmed active exploitation (CISA KEV).
A stack-based out-of-bounds write in Zephyr's OSDP Control Panel reply parser (cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c) lets an attacker on the RS-485 bus overflow fixed 64-byte payload arrays inside a stack-allocated struct osdp_event by declaring an oversized REPLY_KEYPPAD or REPLY_RAW payload length. Any build with CONFIG_OSDP and CONFIG_OSDP_MODE_CP plus an event callback registered is affected, and because nobody validates the reply ID against an outstanding command, a malicious or compromised card reader can answer a routine CMD_POLL with a weaponized frame carrying a correct SOM, valid CRC-16 and matching sequence number. With the default 256-byte UART buffer roughly 180 attacker-chosen bytes land past the event object, corrupting saved registers and the return address on typical Cortex-M/RISC-V layouts, giving crash-to-potential-control-flow-hijack in the OSDP receive thread; no public exploit code has been identified at time of analysis and the issue is bus-adjacent (AV:A) rather than network-reachable.
Malformed 802.1Q Ethernet frames can panic or corrupt the network receive path in Zephyr RTOS builds that have CONFIG_NET_VLAN=y and a VLAN enabled on the receiving Ethernet interface. ethernet_recv() checks only that the first buffer holds a 14-byte plain Ethernet header, then reinterprets that same buffer as an 18-byte VLAN header when the ethertype is 0x8100, reading the TCI and inner ethertype from offsets 14-17 beyond the buffer's length and raising hdr_len to 18 so net_buf_pull() removes more bytes than exist. A single unauthenticated 14-17 byte broadcast frame with ethertype 0x8100 and TCI 0x0000 suffices, reachable by an adjacent/link-local attacker or a malicious USB host through the CDC ECM/NCM gadget classes; assertion-enabled builds panic (denial of service), while production builds with assertions and CONFIG_NET_BUF_HARDENING disabled suffer a uint16_t length underflow to 65534 that leaves later parsers reading far outside the fragment, giving out-of-bounds access with information-disclosure and corruption potential. No public exploit identified at time of analysis; exploitation is gated by the non-default VLAN configuration and hardware VLAN tag stripping absent.
Use-after-free in the Zephyr RTOS Bluetooth LE host lets an adjacent, unauthenticated peer with an established L2CAP connection-oriented channel (CoC) on a dynamic PSM (0x0080-0x00FF) leave a pending work item pointing into channel memory that the application has already been told it may free. The attacker only needs to send a data K-frame immediately followed by an L2CAP Disconnect Request; because the Bluetooth RX workqueue outranks the system workqueue under cooperative scheduling, the deferred rx_work item cannot run before teardown, so the stack's released() callback fires while the system workqueue still holds a reference, producing memory corruption, information disclosure, or a corrupted workqueue pending list. The vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N) reflects adjacent-only access, no privileges, and a scheduling race that must be won, and realistic exploitability is further reduced by the requirement that the application free or re-accept the channel in released(). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; an upstream fix commit is available.
An out-of-bounds write of up to 127 bytes in the Zephyr RTOS NXP MCUX TRNG entropy driver (drivers/entropy/entropy_mcux_trng.c) allows a locally-present attacker to corrupt memory immediately following a caller-supplied buffer on affected NXP i.MX RT5xx/RT6xx SoCs. Because entropy_get_entropy() is a syscall whose verifier (K_SYSCALL_MEMORY_WRITE) checks only the requested length, an unprivileged user-mode thread that has merely been granted the entropy device can supply a length such as 1 and an arbitrary destination, causing the kernel to write 128 bytes where 1 was proven to be owned; on these Cortex-M33 parts there is no MMU, so the overflow can land in adjacent kernel state. The same defect is reachable from kernel mode via getentropy() or sys_rand8_get()/sys_rand16_get() where those resolve to the hardware generator. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but exploitation is local, deterministic in offset, and low complexity, which the assessed vector captures as AV:L/AC:L/PR:L with changed scope and high integrity impact.
An unauthenticated attacker on the same link can crash or partially leak memory from Zephyr IPv6 devices by sending a unicast packet to a neighbor entry that is still in the unresolved state: net_route_ipv6_packet() reads the link-layer address at index NET_NBR_LLADDR_UNKNOWN (0xff) and returns a pointer roughly 2.5 KB past the end of the neighbor link-layer address array. Because builds with CONFIG_ASSERT enabled fire the misplaced assertion and panic, the primary outcome is a repeatable remote denial of service (CVSS 7.1, AV:A/AC:L/PR:N/UI:N, A:H), while builds with assertions disabled instead copy up to 8 bytes of unrelated static RAM into the destination link-layer address of the outgoing frame, disclosing them to any listener (C:L). Exploitation requires no router or forwarding configuration: CONFIG_NET_IPV6_ROUTE is enabled by default whenever the IPv6 neighbor cache is, and the attacker only needs to first force a neighbor into the unresolved state (e.g. by eliciting traffic to a spoofed non-existent address, or by sending a Router Advertisement without a source link-layer address option) before sending the trigger packet. No public exploit code was identified at time of analysis.
Local privilege escalation and sandbox escape in Zephyr RTOS affects builds with CONFIG_USERSPACE enabled that include a fuel-gauge driver: the syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() size kernel-side variable-length arrays directly from an unvalidated caller-supplied len, letting any user-mode thread displace the supervisor stack and, where the caller holds fuel-gauge object permissions, write len * sizeof(union fuel_gauge_prop_val) bytes of attacker-controlled data into privileged memory. The outcome is an out-of-bounds write executing in supervisor mode with attacker-chosen length and content, leading to kernel code execution or a device crash; with the default CONFIG_PRIVILEGED_STACK_SIZE of 1024 bytes, a len of roughly 170 is sufficient to overrun the privileged stack, and a hardware stack guard does not contain it because the copy begins below the guard and walks upward. CVSS 3.1 rates this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the vector requires the attacker to already hold a low-privilege foothold - here, the ability to execute a user-mode thread on the device - and no public exploit code has been identified at time of analysis.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread, in builds that enable both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT, to pass a user-writable kernel object - most practically a thread stack from k_thread_stack_alloc() or a granted static K_THREAD_STACK - to the device_deinit() syscall and achieve supervisor-mode code execution. The flaw is a type-confusion issue in z_vrfy_device_deinit(): validation with K_OBJ_ANY skips the object type comparison, so z_impl_device_deinit() treats attacker-written bytes as a struct device and follows attacker-controlled state and ops.deinit pointers. The upstream fix is available via commit 1036694889ab33996db41b4141ddf66aa786d267, no public exploit code was identified at time of analysis, and impact is gated by the required build configuration; v4.2.x and v4.3.x defaulted the vulnerable option to y, while v4.4.x is exposed only if explicitly enabled.
Sandbox escape and kernel-level out-of-bounds write in the Zephyr RTOS userspace subsystem: an unprivileged user-mode thread that holds an assigned resource pool can pass a size near SIZE_MAX to the k_object_alloc_size() syscall (or the thread-stack branch via k_thread_stack_alloc()), causing an unsigned integer wrap-around in dynamic_object_create() so that a few-byte heap chunk is allocated while the object descriptor is registered under the caller's requested type. The subsequent init syscall (for example k_mutex_init(), k_sem_init(), or k_thread_create()) then writes a full kernel object over the truncated allocation, giving a supervisor-mode heap overflow of attacker-influenced size and content that corrupts sys_heap chunk metadata and adjacent kernel objects, and - when CONFIG_GEN_PRIV_STACKS is set - plants an attacker-influenced wild pointer as a user thread's privileged stack base. This is a local, high-priority privilege-escalation issue (CVSS 8.8, AV:L/PR:L/S:C) rather than a remotely reachable one: exploitation requires code execution as an unprivileged thread inside the CONFIG_USERSPACE sandbox on a build that also enables CONFIG_DYNAMIC_OBJECTS (or CONFIG_DYNAMIC_THREAD under userspace) and that assigns a resource pool to the calling thread; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. The vendor has published a fix that rejects both overflowing computations and frees the partially built descriptor.
Zephyr RTOS running on ARM64 with CONFIG_USERSPACE can lose memory-domain isolation: after an application creates more than 255 memory domains over its lifetime, the bare round-robin ASID allocator in arch_mem_domain_init() wraps and hands the same non-global ASID to two live domains, allowing a user-mode thread in one domain to read and write memory belonging to another domain's partitions and thread stacks using that domain's permissions. Exploitation is constrained rather than trivial - k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only APIs with no syscall surface, so an unprivileged thread cannot drive the counter itself and the vulnerable application must itself create enough domains to wrap the allocator, and the ASID duplication must additionally coincide with a scheduling path that skips the TLB flush in z_arm64_swap_ptables() (for example the A->B->C three-domain sequence, or two aliased domains resident on separate CPUs under SMP). No public exploit code identified at time of analysis, and a vendor fix is available upstream, so this registers as moderate rather than urgent risk.
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attacker within Bluetooth radio range write attacker-chosen bytes into static .bss state by broadcasting a crafted Basic Audio Announcement (BASE) with more subgroups or a larger metadata LTV than the sink's fixed arrays can hold. No pairing, bonding, GATT connection, or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8); the target must be a build with CONFIG_BT_BAP_BROADCAST_SINK enabled and must be periodic-advertising-synced to the attacker's source, or to an advertiser whose address and SID the attacker impersonates (periodic advertising data is unauthenticated). Impact includes corruption of adjacent Bluetooth-audio state with potential remote code execution in the Bluetooth RX thread, plus out-of-bounds disclosure via the BAS receive-state notification; no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is a genuine high-priority flaw rather than a CVSS-inflated paper risk, and an upstream fix is available.
A stack-based buffer overflow in Zephyr's Bluetooth Mesh On-Demand Private Proxy solicitation handler lets any BLE device within radio range overwrite a target node's stack with attacker-controlled bytes by sending a non-connectable advertisement carrying an oversized mesh Proxy Solicitation. Exploitation requires no pairing, bonding, provisioning, or key material because the vulnerable copy happens before decryption, but it is limited to nodes built with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV that are currently eligible to be solicited (GATT Proxy disabled, On-Demand Private Proxy enabled) and physically within BLE range (CVSS 8.8, AV:A/PR:N/C:H/I:H/A:H, unauthenticated). Impact ranges from a reliable remote denial of service to plausible remote code execution; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor fix is available.
An integer underflow in Zephyr's IEEE 802.15.4 link-layer security receive path lets any attacker within radio range drive an out-of-bounds read and in-place write of up to roughly 240 bytes into the network buffer pool. When CONFIG_NET_L2_IEEE802154_SECURITY is enabled and a security session at a level other than IEEE802154_SECURITY_LEVEL_NONE is established, a single crafted data frame whose payload is shorter than the configured authentication tag makes payload_len wrap to as large as 255, so CCM decryption reads several hundred bytes past the end of the exactly-sized receive buffer - and this happens before the tag is ever verified, so no key material, association, authentication, or user interaction is needed (CVSS 8.1, AV:A/AC:L/PR:N/UI:N). The primary impact is memory corruption and denial of service rather than information disclosure, since the out-of-bounds bytes are not attacker-chosen and the frame is dropped when tag verification fails; no public exploit code was identified at time of analysis, and exposure is limited to builds that enable this non-default, experimental security feature.
Zephyr RTOS builds that enable CONFIG_USERSPACE and include an I3C controller driver allow an unprivileged user-mode thread with a grant on the I3C controller device object to escalate to supervisor privilege. The syscall verifier z_vrfy_i3c_do_ccc() checked the outer i3c_ccc_payload, the broadcast data buffer and the targets.payloads[] array but never validated the per-target data pointers carried inside each struct i3c_ccc_target_payload, and it validated the caller's live structure rather than a snapshot, so the driver dereferences an attacker-chosen kernel address; a read CCC turns this into an arbitrary-length out-of-bounds kernel write and a write CCC into a kernel memory disclosure (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-822). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is strictly local - there is no remote or network attack path. An upstream fix commit exists that snapshots the payload, copies the target array into kernel memory and validates every per-target buffer with K_SYSCALL_MEMORY(), but no tagged release version containing it was independently confirmed from the provided data.
Out-of-bounds kernel memory writes in the NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) of Zephyr RTOS let a local user-mode thread that has already been granted the ADC device object corrupt memory beyond an undersized buffer it supplies to the adc_read()/adc_read_async() syscalls. Exploitation of the privilege boundary requires a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC with the GAU ADC devicetree node enabled; the attack vector is localized (CVSS 3.1 8.4, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) and the caller must already hold a device-object grant, but the scope change (S:C) and high integrity/availability impact reflect a genuine userspace-to-kernel privilege escalation path capable of kernel memory corruption or a crash. No public exploit code and no confirmed active exploitation were identified at time of analysis; builds without CONFIG_USERSPACE or on SoCs other than RW61x with the GAU ADC node enabled are not exposed to the privilege boundary and only suffer a silent overflow when the application itself passes an undersized buffer.
A supervisor-mode out-of-bounds write exists in the Zephyr RTOS 802.15.4 L2 transmit path: ieee802154_send() copies packet data into a fixed 125-byte frame buffer without validating the packet length on the unfragmented code path. On builds with CONFIG_NET_L2_IEEE802154_FRAGMENT (enabled by default with CONFIG_NET_6LO), local code that opens a NET_AF_PACKET socket (NET_SOCK_RAW, which skips the 6LoWPAN encoder, or NET_SOCK_DGRAM, which returns early on the address-family check) bound to an 802.15.4 interface can send a payload larger than IEEE802154_MTU and corrupt memory adjacent to the transmit buffer pool, causing a crash or further compromise of kernel state. The flaw is not reachable from the radio because ieee802154_6lo_encode_pkt() length-checks IPv6 packets and forces fragmentation; in a CONFIG_USERSPACE build an unprivileged thread can reach it through the zsock_socket()/zsock_sendto() syscalls, though the overrun is bounded to roughly ll_hdr_len + 3 bytes with the default fixed-size net_buf configuration. No public exploit code was identified at time of analysis and the vendor patch is available (commit 3d4c6177d2dbd77d12d9b14cd75a00cdbd826227).
An insufficient buffer-size validation defect in Zephyr RTOS's ADI MAX32 ADC driver (drivers/adc/adc_max32.c) allows a local, low-privileged user-mode thread to write up to twice the length of its supplied buffer into kernel memory, producing attacker-controlled out-of-bounds writes at an attacker-chosen offset. Exploitation requires a build compiled with CONFIG_USERSPACE running on ADI MAX32 hardware where the calling thread has already been granted access to a MAX32 ADC device object; on such a build the attacker fully controls channels, buffer, buffer_size and options->extra_samplings, and the resulting corruption of adjacent memory, kernel data or thread stacks is a plausible local privilege-escalation and denial-of-service primitive (CVSS 7.8, AV:L/PR:L). The flaw is not remotely exploitable, and builds without CONFIG_USERSPACE are reduced to a caller-side robustness defect since the application supplies its own buffer; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
An out-of-bounds kernel-mode write in Zephyr RTOS's NXP MCUX LPADC driver (drivers/adc/adc_mcux_lpadc.c) lets an unprivileged user-mode thread corrupt memory outside its own partition, providing a genuine local privilege-escalation and denial-of-service primitive rather than an inflated high-severity score. The bug affects builds compiled with CONFIG_USERSPACE that use the MCUX LPADC driver in interrupt-driven mode (or DMA-driven mode on releases carrying the DMA path), where adc_read()/adc_read_async() are system calls: a thread already granted access to the LPADC device object controls channels, buffer, buffer_size and options->extra_samplings, and can demand up to channels × 65536 samples into a tiny buffer, causing the driver's ISR or DMA callback to walk past the buffer while running in kernel mode where the MPU does not confine it. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the CVSS vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact from an authenticated local attacker, and upstream fixes are available.
Kernel memory corruption in Zephyr RTOS arises from the RTIO userspace syscall verifier z_vrfy_rtio_sqe_copy_in_get_handles(), which validates the RTIO object handle and the incoming sqes array but never checks that the caller-supplied handle out-parameter is writable before executing *handle = sqe in supervisor mode. Any user-mode thread that has been granted a struct rtio kernel object - the normal situation for applications using sensor_read_async_mempool() or the async ADC helpers, which call rtio_sqe_copy_in_get_handles() internally - can supply an arbitrary destination address and thereby obtain a write-what-where primitive that stores a pointer to attacker-controlled ring data at any kernel location, corrupting function pointers, thread structures or memory-domain partition tables and breaking the CONFIG_USERSPACE isolation boundary. The issue is local-only and build-gated (CVSS 7.8, AV:L/PR:L, CWE-787), requires both CONFIG_USERSPACE and CONFIG_RTIO, and no public exploit code has been identified at time of analysis, although an upstream vendor fix and GitHub security advisory are available.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread that holds access to the Intel time-aware GPIO (TGPIO) device object to perform two uncontrolled 8-byte supervisor-mode writes to attacker-chosen kernel addresses via the tgpio_pin_read_ts_ec() syscall. The syscall's verification handler omitted the K_SYSCALL_MEMORY_WRITE() check that the sibling handlers in the same file already perform, converting a benign timestamp read-back into a write-what-where primitive that can corrupt kernel data structures, escalate the calling thread to supervisor privilege, or crash the system. Exposed builds are narrow: CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y must both be set, and because the affected source file failed to compile from v3.6.0 until after it was repaired past v4.4.0, the realistically exposed population is v3.5.0 builds plus downstream trees that locally patched that build breakage; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though it is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Null pointer dereference in Zephyr RTOS's MQTT-SN client subsystem allows a malicious or on-path network actor to crash any Zephyr device running an active MQTT-SN session by suppressing gateway keepalive responses. The defect is a missing assignment from the SYS_SLIST_PEEK_HEAD_CONTAINER macro in process_ping(): gw is never populated, remains NULL, and is subsequently dereferenced and passed to the memory slab allocator. The outcome is a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE) or silent slab free-list corruption on targets where address 0 is writable. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the trivial trigger condition and absence of MQTT-SN authentication make this straightforward for any party controlling or impersonating the client's gateway.
Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.
Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.
Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.
Kernel heap corruption via a double-fetch race condition in Zephyr RTOS's unprivileged socket syscall verifiers allows a local low-privilege attacker to achieve kernel privilege escalation or trigger a kernel denial of service. The flaw exists in z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() within subsys/net/lib/sockets/sockets.c, where msg_iovlen is read twice from live user memory - once to size the kernel heap shadow buffer and once as the iovec copy-loop bound - enabling a cooperating attacker thread to inflate the field between those reads and drive an out-of-bounds write into adjacent kernel heap objects. No public exploit has been identified at time of analysis; an upstream patch commit is confirmed available via the Zephyr project security advisory.
Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Heap-based out-of-bounds write in the Zephyr RTOS hawkBit OTA update client (versions 2.4.0 through <4.5.0) allows a malicious or compromised hawkBit update server to corrupt device heap memory by sending a crafted HTTP response body. The off-by-one flaw in response_json_cb() allocates exactly the response body length with no room for the NUL terminator, writing one byte past the heap object and corrupting adjacent allocator metadata. No public exploit identified at time of analysis, but the SSVC framework rates this as automatable and the trigger is deterministic in Zephyr v4.0.0 and later for any response body exceeding 1100 bytes - a size normal for hawkBit deployment metadata.
Stack buffer over-read and stray one-byte NUL write in Zephyr RTOS's experimental OCPP 1.6 client allow a malicious or compromised OCPP central server - or an on-path attacker exploiting the commonly unencrypted ws:// transport - to crash a connected embedded device by sending a crafted WAMP RPC frame with an oversized uid or action field. The vulnerable helper extract_string_field() uses strncpy() without guaranteeing NUL-termination, causing a subsequent strchr() call to scan unbounded into adjacent stack memory; a secondary defect in extract_payload() compounds this on maximal-length frames. No active exploitation has been confirmed by CISA KEV, but SSVC classification indicates publicly available proof-of-concept code, and EPSS sits at a low 0.19% (10th percentile), consistent with a niche embedded RTOS attack surface.
IPv6 packet forwarding in Zephyr RTOS versions 1.8.0 through 4.4.1 never decremented the hop limit on routed unicast packets, directly violating RFC 8200's mandatory loop-termination mechanism and enabling indefinite packet circulation in routing loops. Both forwarding branches of ipv6_route_packet() in subsys/net/ip - the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()) - were affected, with neither performing a hop-limit check nor decrement before calling net_send_data(). An on-path attacker who can induce or exploit a transient L3 routing loop converts it into a permanent forwarding storm, exhausting CPU and link bandwidth on the Zephyr forwarder and adjacent segments; no public exploit or active exploitation has been identified, and SSVC rates exploitation as none with a non-automatable attack.
Use-after-free in the Zephyr RTOS Bluetooth GATT client stack allows an adjacent Bluetooth peer acting as a GATT server to crash a Zephyr device or potentially redirect its execution by replying to a CCC-write with an ATT Error Response. The defect is a callback-ordering bug in gatt_write_ccc_rsp(): the API-documented termination signal notify(NULL) was emitted before subscribe(), so applications that free or recycle bt_gatt_subscribe_params in their termination handler dereference a dangling function pointer. No public exploit code or CISA KEV entry exists; a vendor patch commit is available but a specific tagged release version has not been confirmed.
Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.
Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.
Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.
Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.
Out-of-bounds read in the Zephyr RTOS LwM2M firmware-update pull client (lwm2m_pull_context.c) lets a malicious or compromised LwM2M management server - or an on-path attacker on a session without strong DTLS - leak adjacent device memory and crash devices by writing an over-long firmware Package URI (/5/0/1). Because the Firmware-Update object stores the URI in a 255-byte buffer but the pull context copies exactly 128 bytes into a fixed buffer with no NUL terminator, subsequent strlen-based parsing over-reads static memory that is then appended to outbound CoAP requests. It affects Zephyr 3.0.0 through 4.4.0 on the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path; there is no CISA KEV listing, EPSS is low (0.28%), and per the SSVC framework a proof-of-concept exists.
Kernel object corruption in Zephyr RTOS (v4.1.0 through v4.4.0) lets a deprivileged user thread on CONFIG_USERSPACE builds re-initialize a live k_pipe to which it has been granted access, orphaning threads already blocked on that pipe. Because z_impl_k_pipe_init() unconditionally resets the ring buffer and wait queues without accounting for pended waiters, a subsequent timeout or wake drives sys_dlist_remove() through dangling pointers, producing an attacker-influenced invalid kernel write, list corruption, lost wakeups, and silent data loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix hardens the k_pipe_init syscall verifier.
Local privilege escalation and kernel memory corruption in Zephyr RTOS on Xtensa SoCs (v3.7.0 through v4.4.0) built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, where arch_buffer_validate() fails open on an integer-overflow edge case, letting an unprivileged user thread trick the kernel into reading or writing arbitrary kernel/partition memory on its behalf. The flaw stems from a default-permit return value combined with a ROUND_UP address-space wrap that skips the MPU probe loop entirely, and it is not caught by the existing syscall-layer overflow guards. Vendor patch is available; no public exploit identified at time of analysis, and this is not in CISA KEV.
Kernel memory corruption in the Zephyr RTOS (versions v1.14.0 through v4.4.0) lets an unprivileged user-mode thread corrupt the kernel's dynamic object-tracking list across the userspace security boundary. The flaw is a use-after-free race (CWE-416) in the obj_list traversal, exploitable only on builds combining CONFIG_SMP, CONFIG_USERSPACE, and CONFIG_DYNAMIC_OBJECTS, and can yield privilege escalation or a kernel crash. No public exploit identified at time of analysis; a vendor patch is available.
Stack out-of-bounds write in the Zephyr RTOS network IP-parsing utility (parse_ipv4() in subsys/net/ip/utils.c) lets a crafted "a.b.c.d:port" address string with an overlong post-colon suffix overflow a 17-byte stack buffer with fully attacker-controlled length and contents, affecting Zephyr 1.9.0 through 4.4.0. Any application that resolves a network-influenced address string via the standard socket API (zsock_getaddrinfo/literal resolution), DNS server-string configuration, or the eswifi Wi-Fi DNS-response path is exposed, yielding at minimum denial of service and potentially control-flow hijack. No public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records proof-of-concept maturity and EPSS is low at 0.35%.
Out-of-bounds write in the WireGuard subsystem of Zephyr RTOS 4.4.0 lets a malicious or compromised WireGuard peer (or an on-path attacker driving an established session) corrupt memory by sending an oversized transport-data datagram. Because the flawed copy occurs before the Poly1305 authentication check, exploitation needs only a valid receiver session index rather than a valid authenticator, and reliably yields at least a remote denial of service on the target device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Zephyr project has published advisory GHSA-3wqm-wgx2-9367 and an upstream fix.
Non-atomic reference-count manipulation in the Zephyr RTOS net_buf library (lib/net_buf/buf.c) allows a double-free/use-after-free when a single buffer is shared and independently unref'd across concurrent contexts. Because buf->ref and the per-data-block ref_count were incremented/decremented with plain C operators despite the API being documented as self-synchronizing, two holders racing net_buf_unref() under SMP or single-core preemption can each conclude they hold the last reference, causing a double k_heap_free()/k_free() (heap-metadata corruption and UAF on heap-hardening poison) for heap/variable-data pools, or a double return to the pool free list for any pool type. All Zephyr releases through v4.4.0 are affected; no public exploit is identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets an adjacent attacker leak controller memory to the HCI host and potentially crash the device. A malicious CIS peer or a broadcaster the device is BIS-synced to sends a framed ISO PDU whose start-segment length field is 0-2, causing a uint8_t underflow (len-3 → 253-255) that copies up to ~255 bytes past the received PDU into an HCI ISO packet. Publicly available exploit code exists (SSVC: poc); it is not listed in CISA KEV, and EPSS is low at 0.17%, indicating no evidence of widespread active exploitation.
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious, spoofed, or on-path DNS server - or any LAN node when mDNS/LLMNR is enabled - return crafted truncated TXT or SRV records that leak residual receive-pool memory to the application, and in some configurations crash the device. It affects Zephyr v4.3.0 and v4.4.0; the SSVC framework records a proof-of-concept, so publicly available exploit code exists, though EPSS is low (0.20%, 10th percentile) and there is no public evidence of active exploitation. The disclosed data is bounded (~64 bytes for TXT, ~6 for SRV) and read-only, but can expose stale contents of prior DNS packets.
Arbitrary file read in the Zephyr RTOS HTTP server (subsys/net/lib/http) lets an unauthenticated remote client retrieve any readable file on the mounted filesystem volume by abusing path-traversal sequences against a registered static-filesystem resource. Affecting Zephyr v4.0.0 through v4.4.0 with CONFIG_FILE_SYSTEM enabled and a static-FS resource registered, the flaw stems from the raw request path being concatenated to the web root without canonicalization in both the HTTP/1 and HTTP/2 front-ends. No public exploit identified at time of analysis, but the bug is trivial to trigger (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and a vendor patch is available.
Memory corruption and denial of service in Zephyr RTOS (v4.0.0 through v4.4.0) arises in the BSD-sockets getaddrinfo() implementation, where a timed-out DNS query is retried without cancelling the prior query, leaving a callback holding a pointer into a stack frame that goes out of scope after getaddrinfo() returns. A network-delivered DNS response matched by its spoofable 16-bit transaction id, or the resolver's own delayed timeout work, then writes through that stale pointer, enabling crashes or reused-stack corruption. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation is gated by a timing/race window reflected in CVSS AC:H.
Out-of-bounds heap write in the Zephyr RTOS IP socket stack (recvmsg/insert_pktinfo) lets an unprivileged local userspace thread corrupt kernel-heap memory on builds using CONFIG_USERSPACE. Affecting Zephyr v3.6.0 through v4.4.0, the flaw is triggered when an application calls recvmsg() with an undersized ancillary (msg_control) buffer on a UDP/IP socket that has IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled and a datagram arrives. There is no public exploit identified at time of analysis and EPSS is low (0.12%), but the memory-corruption primitive gives full C/I/A impact locally.
Out-of-bounds write in Zephyr RTOS Bluetooth Classic Hands-Free Profile (HFP) parser allows an adjacent Bluetooth peer acting as an Audio Gateway to corrupt heap/static memory on devices with CONFIG_BT_HFP_HF enabled. A single malformed +CIND response sent during Service Level Connection setup can crash the Bluetooth host or corrupt adjacent connection state with no user interaction. No public exploit identified at time of analysis, and the upstream fix is available via commit cf7693a in the zephyrproject-rtos repository.
Denial of service (and potential limited memory corruption) in the Zephyr RTOS IPv6 networking stack (versions 3.3.0 through 4.4.0) stems from a use-after-free in the IPv6 Neighbor Discovery send paths, where per-interface ICMP statistics are updated by reading from a network packet after the stack has already freed it. Any unauthenticated on-link node can trigger the Neighbor Advertisement path simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 and CONFIG_NET_STATISTICS_PER_INTERFACE enabled, causing a freed slab block to be dereferenced. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); a vendor patch is available, and impact is largely limited to crashes/DoS with only theoretical limited memory corruption.
Use-after-free in Zephyr RTOS's ICMPv6 stack (v4.2.0-v4.4.0) allows an unauthenticated remote attacker to crash the networking stack and potentially corrupt memory by sending a standard ICMPv6 Echo Request or any IPv6 packet that elicits an ICMPv6 error response. Both `icmpv6_handle_echo_request()` and `net_icmpv6_send_error()` call `net_pkt_iface()` on a packet after transferring it to `net_try_send_data()`, which may synchronously or asynchronously free the packet's memory slab before the statistics update executes. When `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the stale interface pointer is written through (`iface->stats.icmp.sent++`), escalating the read UAF into an attacker-influenced memory write; no public exploit has been identified at time of analysis, but the trigger is a universally available IPv6 primitive.
Remotely triggerable denial of service in the Zephyr RTOS networking stack (versions 1.12.0 through 4.4.x) arises from a use-after-free in the IPv6 MLD code path, where mld_send() reads net_pkt_iface(pkt) after net_send_data() has already transferred packet ownership and the L2 driver freed it back to its memory slab. An unauthenticated attacker on the local link can elicit the vulnerable path by sending a crafted MLDv2 General Query, causing a NULL-pointer dereference crash or, in a narrow race, memory corruption via a stray statistics increment. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.
Remote code execution and denial of service in Zephyr RTOS HTTP server (versions 3.7.0 through 4.3.0) allow unauthenticated network attackers to corrupt stack memory by sending a crafted Sec-WebSocket-Key header during WebSocket upgrade. The flaw is a CWE-170 improper NUL-termination issue where a bounded copy fails to terminate the header buffer, causing strlen() and subsequent concatenation to read and write past stack bounds. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivially reachable attack surface make this a high-priority issue for any Zephyr deployment with CONFIG_HTTP_SERVER_WEBSOCKET enabled.
Memory corruption in the Zephyr RTOS eswifi socket offload driver (CVE-2026-1679) allows local code that can call the socket send API to overflow the fixed `eswifi->buf` buffer with an oversized payload, overwriting adjacent kernel memory in the class of unchecked buffer copies (CWE-120). The 7.8 base score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact but a strictly local attack surface that requires existing low-privilege code execution, a build that compiles in the eswifi offload path, and active use of the Inventek es-WiFi stack - there is no direct remote reach. Publicly available exploit code exists, yet EPSS is only 0.03% (10th percentile) and CISA's SSVC decision framework rates the issue non-automatable with partial technical impact, so this is a genuine but constrained local privilege and stability risk rather than an internet-facing emergency.
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on any device built with CONFIG_DNS_RESOLVER enabled, because the function caches the buffer's remaining tailroom once and reuses that stale value while appending decompressed DNS labels, allowing the terminating null byte to land past the end of the buffer. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but reactive: the target must itself initiate a name lookup and the attacker must be positioned to answer it - by operating a hostile or man-in-the-middle resolver or spoofing responses - so an adversary who cannot influence the device's DNS traffic cannot trigger the fault. Publicly available exploit code exists per the Zephyr GHSA advisory, though the vulnerability is not confirmed actively exploited (no CISA KEV listing) and the EPSS score is low at 0.05% (17th percentile). Our independent assessment agrees on the network/unauthenticated/High-integrity/High-availability profile but rates confidentiality impact Low rather than High.
Cross-session AES key confusion in the Zephyr RTOS Espressif ESP32 hardware crypto driver (drivers/crypto/crypto_esp32_aes.c, shipped in Zephyr 4.3.0 through 4.4.2) causes cipher operations to run under another session's key and direction instead of the key the caller installed. The driver advertises up to four independent cipher sessions, but the ESP32 AES peripheral has a single chip-global key/mode register set that aes_begin_session() programmed once, outside the aes_lock mutex, so a second session opened with a different key silently redirects every subsequent ECB, CBC or CTR operation from the first session, and the threaded pattern of begin-then-operate on separate sessions also races. Impact is cryptographic rather than memory corruption: plaintext the application believed protected under its own key may be encrypted or decrypted under a key the attacker knows or supplied, and encrypt/decrypt direction can be inverted; unauthenticated remote exploitation is constrained to custom applications on ESP32 hardware that hold two or more concurrent sessions with different keys, no stock Zephyr subsystem does so, and no public exploit has been identified at time of analysis (vendor fix merged, projected release 4.5.0).
A null-pointer dereference in the Zephyr Bluetooth Classic Hands-Free Profile Audio Gateway role can crash or hang the Bluetooth host stack when an RFCOMM connect fails after an SDP discovery has already linked the AG object into the SDP client's pending request list. Builds of Zephyr 4.4.0 through 4.4.2 with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG enabled and acting as an Audio Gateway are affected; a nearby BR/EDR device advertising an out-of-range RFCOMM channel (outside 0x01..0x1e) in its SDP Hands-Free record, which requires no pairing to read, deterministically forces the failure path. Impact is availability only - crash or hang of the Bluetooth stack, with no attacker-controlled write - and no public exploit code has been identified at time of analysis; the vendor fix is merged on main and v4.4-branch with the release carrying it forecast as 4.5.0.
A use-after-free in the Zephyr RTOS Bluetooth Classic host lets an adjacent, unauthenticated remote Audio Gateway crash or permanently hang the Bluetooth host thread on devices running 4.4.0 through 4.4.2 as an HFP Hands-Free unit (CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled). When bt_hfp_hf_connect() starts an SDP discovery and the following bt_rfcomm_dlc_connect() fails, the old code wiped the live HFP HF object with memset(), destroying a node still linked into the SDP client's request list and a possibly-queued work item; the host later dereferences the NULL pool and function pointers or walks a self-referential list. Impact is denial of service only (CVSS 5.3, AV:A/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-416) - the stray indirect call goes through an all-zero pointer the attacker does not control, so there is no code execution. No public exploit code was identified at time of analysis, but reachability depends on product application code that feeds a peer-discovered RFCOMM channel into bt_hfp_hf_connect(); the only in-tree caller is the shell sample, which limits exposure in default builds.
Predictable IPv6 interface identifiers in Zephyr RTOS 3.7.0 through 4.4.2 arise because the stack seeds the long-lived secret key behind RFC 7217 stable IIDs (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 temporary IIDs (gen_temporary_iid() in subsys/net/ip/ipv6_pe.c) with sys_rand_get(), an API documented as not cryptographically secure. On boards whose entropy driver selects CONFIG_ENTROPY_NEEDS_PRNG, that API resolves to the shared, invertible xoshiro128++ generator, and on entropy-device backends it silently degrades to k_cycle_get_32() samples on driver failure, so an attacker who passively observes on-wire values drawn from the same stream (ephemeral source ports, DNS query IDs, CoAP message IDs and tokens, DHCPv6 transaction IDs, WebSocket masking keys) can reconstruct the key and then compute a device's stable address for any prefix or link its temporary addresses across networks. Exploitation requires the default-off experimental options CONFIG_NET_IPV6_IID_STABLE or CONFIG_NET_IPV6_PE plus the affected PRNG-backed platform class, and no public exploit has been identified at time of analysis; impact is limited to address predictability and tracking (confidentiality of address-lifetime privacy only), with no memory-safety, integrity or availability effect. No public exploit identified at time of analysis, and the item is not tracked as confirmed actively exploited (CISA KEV).
Zephyr's Bluetooth host (subsys/bluetooth/host, versions 2.3.0 through 4.4.2) can be driven to permanently strand connection reservations: when CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1 and an application runs a directed and an undirected connectable extended advertising set on the same identity, an adjacent, unauthenticated attacker who freely chooses an initiator address mapping to the directed set's target causes the wrong bt_conn to be consumed, leaving the undirected set's reservation unreleasable. Each occurrence burns one CONFIG_BT_MAX_CONN slot until bt_disable() or reboot, and repeated attempts against applications that restart the directed set after each disconnect exhaust the pool so connectable advertising fails with -ENOMEM; the directed set also keeps advertising without a reservation, so genuine connections on it are dropped. Impact is availability only (no memory corruption or information disclosure), the vulnerable configuration is non-default on both Kconfig options, and no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Off-path DNS answer spoofing against the Zephyr DNS stub resolver (subsys/net/lib/dns, builds with CONFIG_DNS_RESOLVER) is made practical by a single static UDP source port that is bound once at resolver initialisation and reused for every query, so only the 16-bit transaction identifier varies - contrary to RFC 5452 section 9.2, which requires both to change. A remote attacker with UDP reachability to the device (same LAN, Wi-Fi or mesh segment, or a globally routable address) can learn that port from any observed query or by scanning for the one ephemeral port that stays silent instead of returning ICMP port-unreachable, then flood forged answers across the identifier space during a query window and race the legitimate server; a win makes the application resolve an attacker-chosen address, and with CONFIG_DNS_RESOLVER_CACHE enabled the forged record persists for its attacker-chosen TTL. Affected versions are >= 1.8.0 through <= 4.4.2; no public exploit code or active exploitation is confirmed, exploitation is probabilistic (the race must be won, and a predictable name must be in flight), and endpoints whose TLS certificates are validated are largely protected. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N (6.5), and vendor fixes are merged on main and the v4.4, v4.3 and v3.7 branches with a projected release in 4.5.0.
Predictable and reused DHCPv4 transaction identifiers in the Zephyr RTOS DHCP client (subsys/net/lib/dhcpv4/dhcpv4.c, versions 1.7.0 through 4.4.2) allow an attacker who has observed or learned a single identifier to forge BOOTP replies that the client accepts. Because parsing applies the router and DNS options to the interface before any state check, one accepted datagram can repoint the device's default gateway and resolvers at attacker-chosen addresses, redirecting its traffic; during RENEWING or REBINDING a forged ACK re-binds the lease with attacker parameters and a forged NAK drops the address and restarts configuration. Remote unauthenticated exploitation is scored CVSS 3.1 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L), the weakness is rated non-emergency on the available signals, and no public exploit code has been identified at time of analysis; fixes are merged upstream and in the v4.4, v4.3 and v3.7 branches, with 4.5.0 projected as the first fixed release.
Out-of-bounds write in the Zephyr ADXL345 RTIO streaming path (drivers/sensor/adi/adxl345/adxl345_stream.c) affects builds from 4.0.0 through 4.4.2 that enable CONFIG_ADXL345_STREAM on a board with an interrupt-wired ADXL345. The completion callback clamps the reported read length to the buffer actually granted by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets bounded by the device-reported entry count, so a truncated allocation causes up to 186 bytes written past the end of the block-pool buffer; a companion defect that failed to reset fifo_total_bytes at batch start can carry a stale offset into the next batch. Exposure is strictly local with high attack complexity and low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L, score 3.6); the written data is accelerometer sample content at the allocation tail, so the realistic outcome is corruption of neighbouring RTIO consumers' buffers or a crash rather than a controllable primitive. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and vendor fixes are merged on main and both release branches with a projected fixed release of 4.5.0.
Authorization bypass in Zephyr RTOS's experimental devmux pseudo-driver allows an unprivileged local user-mode thread to read or change which downstream device a multiplexer forwards to, letting it suppress, redirect, or flip console, log, and shell output. Only builds with CONFIG_USERSPACE=y, CONFIG_DEVMUX=y (and its CONFIG_DEVICE_MUTABLE dependency), and a zephyr,devmux devicetree node are affected, and the CVSS 3.1 score is 5.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. No public exploit identified at time of analysis, and the impact is bounded to the devicetree-fixed downstream device set with no memory-corruption path.
Out-of-bounds write in the Zephyr RTOS Nuvoton NPCX/NPCK eSPI Target-Attached-Flash driver lets an eSPI host that sends a flash write or RPMC OP1 request with an oversized 12-bit header length field push up to roughly 956 bytes of attacker-influenced data past a fixed 16-word buffer in .bss, and also causes up to 4 KB of adjacent controller SRAM to be programmed into SPI flash at a host-chosen address where the host can read it back. Only builds that explicitly enable CONFIG_ESPI_TAF on NPCX/NPCK silicon are exposed - no in-tree Zephyr board turns the option on by default - and the trigger requires host firmware or bus-level control of the eSPI link rather than ordinary host software, which is consistent with the assessed CVSS 6.3 vector (AV:L/PR:H). No public exploit code was identified at time of analysis, and the vendor has published a patched commit plus a GitHub security advisory.
A race condition in Zephyr RTOS's Infineon PSOC 6 BLESS Bluetooth HCI driver lets a connected BLE peer within radio range obtain small amounts of adjacent RAM (up to one HCI/ACL payload) or cause duplicate-dropped HCI packets, because the driver stores its outgoing TX descriptor in a file-scope static that is populated before the serialising semaphore is taken. Only builds using hci_infineon_psoc6_bless.c with CONFIG_BT_HCI_ACL_FLOW_CONTROL=y (the default on this driver's boards) and an application that returns -EINPROGRESS from its L2CAP recv callback and later calls bt_l2cap_chan_recv_complete() are realistically exposed, since that pattern moves the ACL buffer unref onto a preemptible thread that calls bt_send() directly, outside the cooperative TX work queue. Impact is bounded - the driver only reads through the descriptor, so there is no write primitive, no memory corruption, and the leaked bytes are not attacker-chosen; the assessed vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L (4.2). No public exploit identified at time of analysis; an upstream fix commit is published alongside a GitHub security advisory.
An out-of-bounds read in the Zephyr RTOS Bluetooth Classic A2DP host stack allows a paired BR/EDR peer to retrieve roughly 245 bytes of adjacent RAM from the victim device over the air. The bug is reachable only in firmware built with CONFIG_BT_CLASSIC and CONFIG_BT_A2DP that registers at least one non-SBC codec endpoint (MPEG1, MPEG2, ATRAC or vendor), because the SBC path pins the codec IE length to 4 bytes; the attacker must also have completed pairing since the AVDTP L2CAP channel enforces BT_SECURITY_L2 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Impact is limited to read-only disclosure of a bounded region of RAM with no write primitive or code execution, and no public exploit code was identified at time of analysis.
Double-completion of an RTIO submission in the Zephyr RTOS Broadcom AFBR-S50 time-of-flight sensor driver corrupts the RTIO submission pool, causing aliased submissions, writes through already-released RX buffers, and duplicate completions delivered to the application. Only firmware builds that compile in the driver for devicetree compatible brcm,afbr-s50 are affected; the error branch can be triggered by anyone within optical range of the sensor through harsh ambient light, sharp distance transitions, or SPI transfer errors, with no board contact and no authentication required (CVSS 3.1 5.2, AV:P/AC:L/PR:N, C:N/I:L/A:H). No public exploit code was identified at time of analysis, and because the attacker cannot control the corrupted content the realistic outcome is memory corruption and denial of service rather than directed code execution.
Denial of service in the Zephyr RTOS Bluetooth Classic Hands-Free Profile (HF role) allows a remote Audio Gateway peer to permanently leak entries from the fixed HFP TX buffer pool and then deadlock the Bluetooth RX thread, hanging the device until reboot. The bug lives in subsys/bluetooth/host/classic/hfp_hf.c: hfp_hf_disconnected() cancels work items and clears hf->acl but never drains the AT-command buffers queued on hf->tx_pending, and it leaves BT_HFP_HF_FLAG_CONNECTED set, while hfp_hf_create() memsets a reused HF slot without checking whether any work item is still pending or running. Only builds with CONFIG_BT_HFP_HF enabled are affected, and the attacker must reach an established, authenticated HFP session (paired/SSP devices have L2CAP authentication enforced before the RFCOMM channel is reachable), so this is an adjacent-range, authenticated-session availability issue rather than a drive-by one. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the per-cycle leak is trivially repeatable by any connected AG.
A permission-check flaw in Zephyr's RTIO syscall layer lets an unprivileged user-mode thread write into memory it is only permitted to read. In z_vrfy_rtio_cqe_get_mempool_buffer(), the two output parameters buff and buff_len are validated with K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(), so when CONFIG_USERSPACE and CONFIG_RTIO_SYS_MEM_BLOCKS are both enabled and the thread already holds an RTIO context grant, the kernel performs a pointer-sized and a 4-byte supervisor-mode store (a CWE-787 out-of-bounds write through mis-validated output pointers). Pointing those pointers at global read-only flash (.text/.rodata) causes a kernel fault handled by z_fatal_error() and the default fatal handler halts or reboots the device - a reliable denial of service - while targeting a K_MEM_PARTITION_P_RW_U_RO partition yields a partly attacker-controlled write that bypasses user-read-only protection; no data disclosure is possible because the read check still applies, and there is no public exploit identified at time of analysis, with exploitation strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, 6.1).
Denial of service in the Zephyr UpdateHub firmware-over-the-air client can be triggered by a malformed CoAP probe response that omits the sha256sum field, causing z_impl_updatehub_probe() to call strlen() on a NULL pointer. The issue affects Zephyr builds with UpdateHub enabled, especially the default plain-CoAP configuration without CONFIG_UPDATEHUB_DTLS, where an unauthenticated on-path, DNS-spoofing, or source-address-racing attacker can inject the response during automatic polling. Impact is availability only and target-dependent: systems that protect or leave unmapped address 0 halt in Zephyr's fatal handler, while classic Cortex-M targets with a readable vector table may merely reject the request; no public exploit has been identified at time of analysis.
An out-of-bounds read in the Zephyr RTOS STM32WBA IEEE 802.15.4 driver (drivers/ieee802154/ieee802154_stm32wba.c) lets an attacker within radio range of an STM32WBA-based device copy roughly 128 bytes of adjacent RAM into a network packet delivered to the networking stack. The flaw affects Zephyr 4.3.0 through 4.4.2 in the default production configuration (CONFIG_ASSERT=n), where the only length bound is compiled out; builds with CONFIG_ASSERT=y are not exploitable because the assertion would fire first. Impact is limited to a read-only information disclosure and oversized packet allocation in the RX thread - no code execution and no internet-reachable path - and no public exploit identified at time of analysis, with CVSS scored 4.2 (AV:A/AC:H/PR:N/UI:N).
Out-of-bounds write in the Zephyr CC1200 sub-GHz IEEE 802.15.4 driver lets an unauthenticated attacker within radio range transmit a frame whose first byte declares a PHY length above the IEEE 802.15.4 maximum of 127, driving an oversized net_buf allocation and a single SPI burst that can write up to 127 bytes past the end of the first 128-byte buffer fragment. The flaw affects builds that enable CONFIG_IEEE802154_CC1200 with a physically attached CC1200 radio in the driver's default variable-length mode (PKT_LEN = 0xFF), and exploitation is constrained by RF framing/timing requirements (CVSS 3.1 AV:A/AC:H/PR:N/UI:N, CWE-787), with the resulting overflow containing FIFO-underflow bytes so the realistic outcome is network-buffer-pool corruption and crashes rather than a controlled write. An upstream fix is available as a commit to verify_rxfifo_validity(), but no public exploit code or confirmed active exploitation was identified at time of analysis, and no independently confirmed tagged release containing the fix is documented here.
Integer underflow in the NXP KW41Z IEEE 802.15.4 receive path of Zephyr RTOS lets an attacker within radio range corrupt memory in the shared network-buffer pool from interrupt context. The driver samples the over-the-air PHY-header length byte from the ZLL IRQSTS register and subtracts the FCS length in a uint8_t, so a crafted frame advertising a length of one wraps to 255 bytes, which is copied into a single 128-byte net_buf fragment and overruns it by up to 127 bytes while also reading past the end of the radio's RX register array. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited; exploiting it requires RF proximity plus a timing race that the attacker must win by flooding length-one frames.
A use-after-free in Zephyr RTOS's Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) lets an adjacent Bluetooth peer crash or hang the entire device, producing a denial of service. The flaw is reachable only in builds where CONFIG_BT_HFP_AG is enabled (a profile Zephyr marks experimental and ships disabled by default) and where the application implements the optional asynchronous get_ongoing_call callback; a Hands-Free unit sends AT+CIND? during Service Level Connection setup, then tears down and re-opens the HFP RFCOMM DLC on the same ACL link within the ~10-second timeout window, deterministically reusing the same static pool slot while ag->ongoing_call_work is still armed and linked into the kernel timeout list. The repeated memset and k_work_init_delayable corrupt the kernel timeout dlist under an interrupts-locked announce loop, causing a fault or system hang; no attacker-controlled data is written, so code execution is not demonstrated. No public exploit code or in-the-wild exploitation was identified at time of analysis, and the exposed population is sharply limited by the non-default experimental configuration and physical Bluetooth proximity.
Memory corruption in Zephyr's Bluetooth Classic A2DP/AVDTP host stack allows an adjacent, paired BR/EDR peer to crash or hang the entire device by forcing a delayable work item to survive a session teardown. The attacker opens the AVDTP signalling channel, lets the local application issue an AVDTP procedure (the standard A2DP flow calls bt_a2dp_discover(), arming the 6-second AVDTP_TIMEOUT), then tears the channel down without responding and re-opens it within the remaining window, so that a2dp_get_connection() memsets the session while its timeout node is still linked into the kernel's global timeout list. Preconditions are narrow - the victim must run the experimental CONFIG_BT_A2DP option with the default CONFIG_TIMEOUT_BACKEND_DLIST backend and accept an encrypted (paired) BR/EDR link, which is why the assessed severity is a bounded denial-of-service rather than a remote pre-auth compromise; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Memory corruption in the Zephyr RTOS Bluetooth host ATT transmit path can be triggered by a peer in Bluetooth radio range whenever an application issues an ATT Signed Write Command over an unencrypted link. In chan_send(), the BT_ATT_OP_SIGNED_WRITE_CMD branch unrefers a net_buf it does not own after bt_smp_sign() fails (no local CSRK exists for the peer - a state the remote peer controls by pairing without requesting the signing key, pairing with No Bonding, staying unpaired, or keeping the link unencrypted); the callers honor the opposite ownership contract, so the already-freed buffer is re-queued, dereferenced and freed a second time, corrupting the ATT TX FIFO, deferred-destroy and pool free lists, while a related retry path can append a second 12-octet signature into a pooled buffer sized for one. Exploitation requires the deprecated, non-default CONFIG_BT_SIGNING build option plus a victim application that actually performs signed writes, giving CVSS 5.9 (AV:A/AC:H/PR:N, no confidentiality impact, high availability impact, low integrity impact); a vendor fix commit and GHSA-p3r4-qw98-j59m are available, and no public exploit was identified at time of analysis.
Zephyr RTOS Bluetooth Mesh nodes built with the default Access-layer delayed-message feature can be persistently muted by a mesh peer that is already provisioned into the same network and within Bluetooth radio range. By flooding the victim with requests that elicit segmented responses while withholding Segment Acknowledgments, the attacker forces bt_mesh_delayable_msg_manage() down an error path that returns a message context to neither the free nor the busy list, permanently shrinking the default four-entry context pool until every reply from Configuration Server, Health Server and application server models fails with -ENOMEM and is silently dropped. The impact is availability-only (CVSS 5.7, CWE-772, authenticated/PR:L and adjacent/AV:A per the assessed vector); the defect is cleared only by a reboot, the upstream fix is a committed source change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Availability loss in Zephyr RTOS Bluetooth Mesh affects nodes built with the default access-layer delayable message queue, where an unsynchronized race between the host RX thread and the system workqueue lets the handler touch a context slot that has already been purged. The attacker must be a provisioned mesh member - holding the NetKey and a bound AppKey - within Bluetooth radio range, who can control arrival rate, response size and destination address to exhaust the 4-entry context pool and 40-entry chunk pool and force the purge path; the trigger is a narrow, high-complexity race. Winning it produces a read-modify-write through a NULL-based pointer on the system workqueue thread, which on typical targets faults and aborts that thread (stopping all workqueue-driven functionality, including the mesh timing machinery) or resets the node, so impact is availability only - the write value and address are fixed, so there is no memory corruption or code execution path. Scoring is CVSS 3.1 4.8 (AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis, and there is no KEV listing.
The Bluetooth LE Controller in Zephyr RTOS can be faulted or have its receive PDU pool exhausted by a radio-range peer that drives the Link Layer PHY Update procedure into the retained-RX-node state and then sends an unexpected LL Control PDU before the update instant arrives; the invalid-PDU branches of llcp_lp_pu_rx() and llcp_rp_pu_rx() complete the procedure without releasing the retained node, so the procedure context is freed while the node stays out of the receive pool. In the default configuration (CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG both y) the violated invariant trips llcp_lr_check_done()/llcp_rr_check_done() and terminates in k_oops()/k_panic() from a single crafted PDU sequence, while on releases v3.4.0 through v3.7.x the assertion is never reached and each attempt silently leaks one PDU node from a pool that defaults to a single buffer (CONFIG_BT_CTLR_RX_BUFFERS=1), allowing a few reconnects to render Bluetooth inoperable until reboot. No pairing or encryption is required of the attacking peer (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit identified at time of analysis.
Denial of service affects Zephyr RTOS builds that include the Bluetooth Link Layer controller, where an over-the-air peer within Bluetooth radio range can trigger a retained RX node leak without pairing, bonding, or encryption. The peer sends a well-formed LL_CONNECTION_UPDATE_IND with a future instant (or reaches the same state as a central via LL_CONNECTION_PARAM_REQ, or through the local procedure via LL_REJECT_IND) and then, before that instant is reached, any other LL Control PDU such as LL_LENGTH_REQ; the invalid-PDU termination path completes the procedure without releasing the retained node, so llcp_rr_check_done() drops the last reference to it. With the default CONFIG_BT_CTLR_ASSERT_DEBUG enabled this produces an immediate fatal assertion in the controller, and with asserts disabled each occurrence permanently consumes a node from the small fixed RX pool until the receive path operates on NULL, with the impact being availability-only, limited to Bluetooth proximity, and persisting until reboot; no public exploit code was identified at time of analysis and there is no CISA KEV listing.
Bluetooth Object Transfer Service (OTS) servers in Zephyr (>= 3.3.0 through <= 4.4.2) mishandle failed Calculate Checksum responses: oacp_ind_send() appends a four-byte Checksum Value field based only on the requested op code, then calls net_buf_simple_pull_le32() on a zero-length stack buffer whenever validation failed. Any peer within radio range can abuse this with a nine-byte OACP write and no pairing, encryption or authentication, because the OACP characteristic and its CCC are exposed with unauthenticated write permissions. On CONFIG_ASSERT builds the zero-length pull trips the assertion in net_buf_simple_pull_mem() and panics the device (remote DoS); with assertions compiled out the same path copies four bytes of uninitialized stack memory into the indication sent to the peer, repeatable per request and bounded to four bytes with no memory corruption; the reporter's reproducer demonstrates the panic and no public exploit tooling beyond it is confirmed.
An out-of-bounds write in Zephyr's USB device_next Bluetooth HCI transport class (subsys/usb/device_next/class/bt_hci.c) allows memory adjacent to a statically allocated USB transfer pool to be overwritten with attacker-influenced bytes. Zephyr releases from 3.3.0 through 4.4.2 are affected via the CPE cpe:2.3:a:zephyrproject:zephyr, with the remotely reachable triggers applying to full-speed-only builds from v4.2.0 onward where the endpoint pool slot is 64 bytes; an attacker within Bluetooth range needs no authentication and no user interaction, and in the stock full-speed-only configuration the mandatory 70-byte Read Supported Commands event already overruns the slot by six bytes during ordinary host initialization. Silent corruption with potential code execution requires CONFIG_ASSERT=n and no memory protection between subsystems, while assertion-enabled builds panic instead, giving a remotely triggerable denial of service. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the vendor fix is merged upstream but the release containing it is projected rather than shipped.
Stale arm64 TLB entries in Zephyr RTOS 4.3.0 through 4.4.2 let an unprivileged user thread (CVSS PR:L, local access) retain read/write mappings to a physical page frame after the demand paging eviction algorithm has reclaimed and reissued that frame to the kernel or to another memory domain. Because the single-VA invalidation only ever matched ASID 0 and global entries, a domain-private non-global leaf created for a k_mem_partition or a user thread stack survives page-out, enabling information disclosure and memory corruption that breaks CONFIG_USERSPACE isolation with scope-changing impact beyond the vulnerable component. Exploitation requires an arm64 build with both CONFIG_USERSPACE and the experimental CONFIG_DEMAND_PAGING enabled, an active backing store, and a demand-paged page privately mapped into a user memory domain; the attacker must already be running user-mode code and must drive memory pressure to force eviction and immediate frame reuse (AC:H). No public exploit code or PoC reference was identified in the available sources and the issue is not listed in CISA KEV; vendor fix commits are merged upstream on main with a projected fixed version of 4.5.0, while branch backports remain open.
WireGuard in Zephyr (subsys/net/lib/wireguard) accepts an unauthenticated transport-data datagram and copies its source address into peer->endpoint, letting any host that can reach the listener's UDP port 51820 off-path redirect all subsequent handshake initiations, keepalives and encrypted tunnel traffic to an address of the attacker's choosing. Affected builds are Zephyr 4.4.0 through 4.4.2 with CONFIG_WIREGUARD enabled, which is marked experimental and off by default, and the defect fires only while the targeted peer has no valid handshake and no current keypair - the state at boot and after a session expires. The result is persistent tunnel denial (assessed A:H) and limited confidentiality loss (C:L) through traffic-metadata observation or selective dropping if the attacker relays redirected initiations; the Noise/AEAD cryptography prevents decryption or forgery, so keys are not compromised. The advisory's original report includes a 16-byte datagram recipe as a proof of concept; it is not verified as working exploit code, no public exploit is confirmed in use, and KEV status is not indicated - exploitation requires only UDP reachability to the listener, with no credentials or user interaction.
Zephyr's OpenThread joiner autostart can cause an uncommissioned device to join an attacker-controlled Thread mesh because the build defaulted to the public Joining Device Credential 'J01NME'. Builds with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that leave CONFIG_OPENTHREAD_JOINER_PSKD unset are affected, and an attacker within 802.15.4 radio range running a commissioner with that same PSKd can complete commissioning and supply an arbitrary operational dataset. A reporter-supplied PoC reference exists but is not independently verified as working exploit code; joiner autostart is not enabled by default and no in-tree Zephyr sample uses the vulnerable combination.
A stale-state flaw in Zephyr's experimental MCTP-over-I2C+GPIO target binding lets any device that can act as an I2C controller on the shared management bus crash the target with two ordinary transactions, because the selected pseudo-register and data-phase flag are never reset at STOP. The resulting NULL pointer dereference occurs inside the I2C target interrupt handler, so on parts that trap address-0 accesses it produces a fatal exception and device reset or halt; on other parts it degrades to a malformed packet buffer reaching the MCTP stack and silently dropped transmit packets. Only builds with CONFIG_MCTP and CONFIG_MCTP_I2C_GPIO_TARGET=y are exposed, exploitation requires a pre-existing foothold on the same physical bus (compromised peer endpoint or BMC), and no public exploit code was identified at time of analysis; the authoritative assessment scores this as availability-only impact (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the C:L/I:N variant in the published vector.
Missing scheduler-lock protection in Zephyr RTOS's z_waitq_head() helper lets a local unprivileged user-mode thread race the kernel timer expiration handler against thread abort on multi-core builds, yielding use-after-free and out-of-bounds writes performed in supervisor context along with scheduler state corruption; the more common outcome of a lost race is a kernel crash rather than controlled corruption. Only builds with CONFIG_MP_MAX_NUM_CPUS greater than one and CONFIG_USERSPACE enabled are exposed, since the affected code path is a no-op on uniprocessor targets and the required k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() primitives are syscalls. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and the narrow timing window keeps practical risk conditional rather than drive-by.
User-mode-to-kernel escape in Zephyr RTOS lets a local thread that holds a granted PECI device object turn peci_transfer() into arbitrary supervisor-mode read and write primitives. The syscall verifier z_vrfy_peci_transfer() validated only the outer struct peci_msg and then handed the caller-controlled tx_buffer/rx_buffer pointers and lengths to in-tree drivers (NPCX, IT8xxx2, MCHP XEC), which dereference them in supervisor mode - allowing kernel memory to be overwritten with hardware-supplied bytes, kernel contents to be pushed onto the PECI/eSPI bus, or a supervisor fault via an unmapped address. Scoring is CVSS 3.1 7.8 (AV:L/PR:L, C:H/I:H/A:H) and exploitation is gated on CONFIG_USERSPACE=y, an enabled vulnerable PECI driver, and local code execution in a thread already granted the PECI device; no public exploit code exists at time of analysis and there is no confirmed active exploitation (CISA KEV).
A stack-based out-of-bounds write in Zephyr's OSDP Control Panel reply parser (cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c) lets an attacker on the RS-485 bus overflow fixed 64-byte payload arrays inside a stack-allocated struct osdp_event by declaring an oversized REPLY_KEYPPAD or REPLY_RAW payload length. Any build with CONFIG_OSDP and CONFIG_OSDP_MODE_CP plus an event callback registered is affected, and because nobody validates the reply ID against an outstanding command, a malicious or compromised card reader can answer a routine CMD_POLL with a weaponized frame carrying a correct SOM, valid CRC-16 and matching sequence number. With the default 256-byte UART buffer roughly 180 attacker-chosen bytes land past the event object, corrupting saved registers and the return address on typical Cortex-M/RISC-V layouts, giving crash-to-potential-control-flow-hijack in the OSDP receive thread; no public exploit code has been identified at time of analysis and the issue is bus-adjacent (AV:A) rather than network-reachable.
Malformed 802.1Q Ethernet frames can panic or corrupt the network receive path in Zephyr RTOS builds that have CONFIG_NET_VLAN=y and a VLAN enabled on the receiving Ethernet interface. ethernet_recv() checks only that the first buffer holds a 14-byte plain Ethernet header, then reinterprets that same buffer as an 18-byte VLAN header when the ethertype is 0x8100, reading the TCI and inner ethertype from offsets 14-17 beyond the buffer's length and raising hdr_len to 18 so net_buf_pull() removes more bytes than exist. A single unauthenticated 14-17 byte broadcast frame with ethertype 0x8100 and TCI 0x0000 suffices, reachable by an adjacent/link-local attacker or a malicious USB host through the CDC ECM/NCM gadget classes; assertion-enabled builds panic (denial of service), while production builds with assertions and CONFIG_NET_BUF_HARDENING disabled suffer a uint16_t length underflow to 65534 that leaves later parsers reading far outside the fragment, giving out-of-bounds access with information-disclosure and corruption potential. No public exploit identified at time of analysis; exploitation is gated by the non-default VLAN configuration and hardware VLAN tag stripping absent.
Use-after-free in the Zephyr RTOS Bluetooth LE host lets an adjacent, unauthenticated peer with an established L2CAP connection-oriented channel (CoC) on a dynamic PSM (0x0080-0x00FF) leave a pending work item pointing into channel memory that the application has already been told it may free. The attacker only needs to send a data K-frame immediately followed by an L2CAP Disconnect Request; because the Bluetooth RX workqueue outranks the system workqueue under cooperative scheduling, the deferred rx_work item cannot run before teardown, so the stack's released() callback fires while the system workqueue still holds a reference, producing memory corruption, information disclosure, or a corrupted workqueue pending list. The vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N) reflects adjacent-only access, no privileges, and a scheduling race that must be won, and realistic exploitability is further reduced by the requirement that the application free or re-accept the channel in released(). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; an upstream fix commit is available.
An out-of-bounds write of up to 127 bytes in the Zephyr RTOS NXP MCUX TRNG entropy driver (drivers/entropy/entropy_mcux_trng.c) allows a locally-present attacker to corrupt memory immediately following a caller-supplied buffer on affected NXP i.MX RT5xx/RT6xx SoCs. Because entropy_get_entropy() is a syscall whose verifier (K_SYSCALL_MEMORY_WRITE) checks only the requested length, an unprivileged user-mode thread that has merely been granted the entropy device can supply a length such as 1 and an arbitrary destination, causing the kernel to write 128 bytes where 1 was proven to be owned; on these Cortex-M33 parts there is no MMU, so the overflow can land in adjacent kernel state. The same defect is reachable from kernel mode via getentropy() or sys_rand8_get()/sys_rand16_get() where those resolve to the hardware generator. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but exploitation is local, deterministic in offset, and low complexity, which the assessed vector captures as AV:L/AC:L/PR:L with changed scope and high integrity impact.
An unauthenticated attacker on the same link can crash or partially leak memory from Zephyr IPv6 devices by sending a unicast packet to a neighbor entry that is still in the unresolved state: net_route_ipv6_packet() reads the link-layer address at index NET_NBR_LLADDR_UNKNOWN (0xff) and returns a pointer roughly 2.5 KB past the end of the neighbor link-layer address array. Because builds with CONFIG_ASSERT enabled fire the misplaced assertion and panic, the primary outcome is a repeatable remote denial of service (CVSS 7.1, AV:A/AC:L/PR:N/UI:N, A:H), while builds with assertions disabled instead copy up to 8 bytes of unrelated static RAM into the destination link-layer address of the outgoing frame, disclosing them to any listener (C:L). Exploitation requires no router or forwarding configuration: CONFIG_NET_IPV6_ROUTE is enabled by default whenever the IPv6 neighbor cache is, and the attacker only needs to first force a neighbor into the unresolved state (e.g. by eliciting traffic to a spoofed non-existent address, or by sending a Router Advertisement without a source link-layer address option) before sending the trigger packet. No public exploit code was identified at time of analysis.
Local privilege escalation and sandbox escape in Zephyr RTOS affects builds with CONFIG_USERSPACE enabled that include a fuel-gauge driver: the syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() size kernel-side variable-length arrays directly from an unvalidated caller-supplied len, letting any user-mode thread displace the supervisor stack and, where the caller holds fuel-gauge object permissions, write len * sizeof(union fuel_gauge_prop_val) bytes of attacker-controlled data into privileged memory. The outcome is an out-of-bounds write executing in supervisor mode with attacker-chosen length and content, leading to kernel code execution or a device crash; with the default CONFIG_PRIVILEGED_STACK_SIZE of 1024 bytes, a len of roughly 170 is sufficient to overrun the privileged stack, and a hardware stack guard does not contain it because the copy begins below the guard and walks upward. CVSS 3.1 rates this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the vector requires the attacker to already hold a low-privilege foothold - here, the ability to execute a user-mode thread on the device - and no public exploit code has been identified at time of analysis.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread, in builds that enable both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT, to pass a user-writable kernel object - most practically a thread stack from k_thread_stack_alloc() or a granted static K_THREAD_STACK - to the device_deinit() syscall and achieve supervisor-mode code execution. The flaw is a type-confusion issue in z_vrfy_device_deinit(): validation with K_OBJ_ANY skips the object type comparison, so z_impl_device_deinit() treats attacker-written bytes as a struct device and follows attacker-controlled state and ops.deinit pointers. The upstream fix is available via commit 1036694889ab33996db41b4141ddf66aa786d267, no public exploit code was identified at time of analysis, and impact is gated by the required build configuration; v4.2.x and v4.3.x defaulted the vulnerable option to y, while v4.4.x is exposed only if explicitly enabled.
Sandbox escape and kernel-level out-of-bounds write in the Zephyr RTOS userspace subsystem: an unprivileged user-mode thread that holds an assigned resource pool can pass a size near SIZE_MAX to the k_object_alloc_size() syscall (or the thread-stack branch via k_thread_stack_alloc()), causing an unsigned integer wrap-around in dynamic_object_create() so that a few-byte heap chunk is allocated while the object descriptor is registered under the caller's requested type. The subsequent init syscall (for example k_mutex_init(), k_sem_init(), or k_thread_create()) then writes a full kernel object over the truncated allocation, giving a supervisor-mode heap overflow of attacker-influenced size and content that corrupts sys_heap chunk metadata and adjacent kernel objects, and - when CONFIG_GEN_PRIV_STACKS is set - plants an attacker-influenced wild pointer as a user thread's privileged stack base. This is a local, high-priority privilege-escalation issue (CVSS 8.8, AV:L/PR:L/S:C) rather than a remotely reachable one: exploitation requires code execution as an unprivileged thread inside the CONFIG_USERSPACE sandbox on a build that also enables CONFIG_DYNAMIC_OBJECTS (or CONFIG_DYNAMIC_THREAD under userspace) and that assigns a resource pool to the calling thread; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. The vendor has published a fix that rejects both overflowing computations and frees the partially built descriptor.
Zephyr RTOS running on ARM64 with CONFIG_USERSPACE can lose memory-domain isolation: after an application creates more than 255 memory domains over its lifetime, the bare round-robin ASID allocator in arch_mem_domain_init() wraps and hands the same non-global ASID to two live domains, allowing a user-mode thread in one domain to read and write memory belonging to another domain's partitions and thread stacks using that domain's permissions. Exploitation is constrained rather than trivial - k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only APIs with no syscall surface, so an unprivileged thread cannot drive the counter itself and the vulnerable application must itself create enough domains to wrap the allocator, and the ASID duplication must additionally coincide with a scheduling path that skips the TLB flush in z_arm64_swap_ptables() (for example the A->B->C three-domain sequence, or two aliased domains resident on separate CPUs under SMP). No public exploit code identified at time of analysis, and a vendor fix is available upstream, so this registers as moderate rather than urgent risk.
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attacker within Bluetooth radio range write attacker-chosen bytes into static .bss state by broadcasting a crafted Basic Audio Announcement (BASE) with more subgroups or a larger metadata LTV than the sink's fixed arrays can hold. No pairing, bonding, GATT connection, or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8); the target must be a build with CONFIG_BT_BAP_BROADCAST_SINK enabled and must be periodic-advertising-synced to the attacker's source, or to an advertiser whose address and SID the attacker impersonates (periodic advertising data is unauthenticated). Impact includes corruption of adjacent Bluetooth-audio state with potential remote code execution in the Bluetooth RX thread, plus out-of-bounds disclosure via the BAS receive-state notification; no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is a genuine high-priority flaw rather than a CVSS-inflated paper risk, and an upstream fix is available.
A stack-based buffer overflow in Zephyr's Bluetooth Mesh On-Demand Private Proxy solicitation handler lets any BLE device within radio range overwrite a target node's stack with attacker-controlled bytes by sending a non-connectable advertisement carrying an oversized mesh Proxy Solicitation. Exploitation requires no pairing, bonding, provisioning, or key material because the vulnerable copy happens before decryption, but it is limited to nodes built with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV that are currently eligible to be solicited (GATT Proxy disabled, On-Demand Private Proxy enabled) and physically within BLE range (CVSS 8.8, AV:A/PR:N/C:H/I:H/A:H, unauthenticated). Impact ranges from a reliable remote denial of service to plausible remote code execution; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor fix is available.
An integer underflow in Zephyr's IEEE 802.15.4 link-layer security receive path lets any attacker within radio range drive an out-of-bounds read and in-place write of up to roughly 240 bytes into the network buffer pool. When CONFIG_NET_L2_IEEE802154_SECURITY is enabled and a security session at a level other than IEEE802154_SECURITY_LEVEL_NONE is established, a single crafted data frame whose payload is shorter than the configured authentication tag makes payload_len wrap to as large as 255, so CCM decryption reads several hundred bytes past the end of the exactly-sized receive buffer - and this happens before the tag is ever verified, so no key material, association, authentication, or user interaction is needed (CVSS 8.1, AV:A/AC:L/PR:N/UI:N). The primary impact is memory corruption and denial of service rather than information disclosure, since the out-of-bounds bytes are not attacker-chosen and the frame is dropped when tag verification fails; no public exploit code was identified at time of analysis, and exposure is limited to builds that enable this non-default, experimental security feature.
Zephyr RTOS builds that enable CONFIG_USERSPACE and include an I3C controller driver allow an unprivileged user-mode thread with a grant on the I3C controller device object to escalate to supervisor privilege. The syscall verifier z_vrfy_i3c_do_ccc() checked the outer i3c_ccc_payload, the broadcast data buffer and the targets.payloads[] array but never validated the per-target data pointers carried inside each struct i3c_ccc_target_payload, and it validated the caller's live structure rather than a snapshot, so the driver dereferences an attacker-chosen kernel address; a read CCC turns this into an arbitrary-length out-of-bounds kernel write and a write CCC into a kernel memory disclosure (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-822). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is strictly local - there is no remote or network attack path. An upstream fix commit exists that snapshots the payload, copies the target array into kernel memory and validates every per-target buffer with K_SYSCALL_MEMORY(), but no tagged release version containing it was independently confirmed from the provided data.
Out-of-bounds kernel memory writes in the NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) of Zephyr RTOS let a local user-mode thread that has already been granted the ADC device object corrupt memory beyond an undersized buffer it supplies to the adc_read()/adc_read_async() syscalls. Exploitation of the privilege boundary requires a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC with the GAU ADC devicetree node enabled; the attack vector is localized (CVSS 3.1 8.4, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) and the caller must already hold a device-object grant, but the scope change (S:C) and high integrity/availability impact reflect a genuine userspace-to-kernel privilege escalation path capable of kernel memory corruption or a crash. No public exploit code and no confirmed active exploitation were identified at time of analysis; builds without CONFIG_USERSPACE or on SoCs other than RW61x with the GAU ADC node enabled are not exposed to the privilege boundary and only suffer a silent overflow when the application itself passes an undersized buffer.
A supervisor-mode out-of-bounds write exists in the Zephyr RTOS 802.15.4 L2 transmit path: ieee802154_send() copies packet data into a fixed 125-byte frame buffer without validating the packet length on the unfragmented code path. On builds with CONFIG_NET_L2_IEEE802154_FRAGMENT (enabled by default with CONFIG_NET_6LO), local code that opens a NET_AF_PACKET socket (NET_SOCK_RAW, which skips the 6LoWPAN encoder, or NET_SOCK_DGRAM, which returns early on the address-family check) bound to an 802.15.4 interface can send a payload larger than IEEE802154_MTU and corrupt memory adjacent to the transmit buffer pool, causing a crash or further compromise of kernel state. The flaw is not reachable from the radio because ieee802154_6lo_encode_pkt() length-checks IPv6 packets and forces fragmentation; in a CONFIG_USERSPACE build an unprivileged thread can reach it through the zsock_socket()/zsock_sendto() syscalls, though the overrun is bounded to roughly ll_hdr_len + 3 bytes with the default fixed-size net_buf configuration. No public exploit code was identified at time of analysis and the vendor patch is available (commit 3d4c6177d2dbd77d12d9b14cd75a00cdbd826227).
An insufficient buffer-size validation defect in Zephyr RTOS's ADI MAX32 ADC driver (drivers/adc/adc_max32.c) allows a local, low-privileged user-mode thread to write up to twice the length of its supplied buffer into kernel memory, producing attacker-controlled out-of-bounds writes at an attacker-chosen offset. Exploitation requires a build compiled with CONFIG_USERSPACE running on ADI MAX32 hardware where the calling thread has already been granted access to a MAX32 ADC device object; on such a build the attacker fully controls channels, buffer, buffer_size and options->extra_samplings, and the resulting corruption of adjacent memory, kernel data or thread stacks is a plausible local privilege-escalation and denial-of-service primitive (CVSS 7.8, AV:L/PR:L). The flaw is not remotely exploitable, and builds without CONFIG_USERSPACE are reduced to a caller-side robustness defect since the application supplies its own buffer; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
An out-of-bounds kernel-mode write in Zephyr RTOS's NXP MCUX LPADC driver (drivers/adc/adc_mcux_lpadc.c) lets an unprivileged user-mode thread corrupt memory outside its own partition, providing a genuine local privilege-escalation and denial-of-service primitive rather than an inflated high-severity score. The bug affects builds compiled with CONFIG_USERSPACE that use the MCUX LPADC driver in interrupt-driven mode (or DMA-driven mode on releases carrying the DMA path), where adc_read()/adc_read_async() are system calls: a thread already granted access to the LPADC device object controls channels, buffer, buffer_size and options->extra_samplings, and can demand up to channels × 65536 samples into a tiny buffer, causing the driver's ISR or DMA callback to walk past the buffer while running in kernel mode where the MPU does not confine it. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the CVSS vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact from an authenticated local attacker, and upstream fixes are available.
Kernel memory corruption in Zephyr RTOS arises from the RTIO userspace syscall verifier z_vrfy_rtio_sqe_copy_in_get_handles(), which validates the RTIO object handle and the incoming sqes array but never checks that the caller-supplied handle out-parameter is writable before executing *handle = sqe in supervisor mode. Any user-mode thread that has been granted a struct rtio kernel object - the normal situation for applications using sensor_read_async_mempool() or the async ADC helpers, which call rtio_sqe_copy_in_get_handles() internally - can supply an arbitrary destination address and thereby obtain a write-what-where primitive that stores a pointer to attacker-controlled ring data at any kernel location, corrupting function pointers, thread structures or memory-domain partition tables and breaking the CONFIG_USERSPACE isolation boundary. The issue is local-only and build-gated (CVSS 7.8, AV:L/PR:L, CWE-787), requires both CONFIG_USERSPACE and CONFIG_RTIO, and no public exploit code has been identified at time of analysis, although an upstream vendor fix and GitHub security advisory are available.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread that holds access to the Intel time-aware GPIO (TGPIO) device object to perform two uncontrolled 8-byte supervisor-mode writes to attacker-chosen kernel addresses via the tgpio_pin_read_ts_ec() syscall. The syscall's verification handler omitted the K_SYSCALL_MEMORY_WRITE() check that the sibling handlers in the same file already perform, converting a benign timestamp read-back into a write-what-where primitive that can corrupt kernel data structures, escalate the calling thread to supervisor privilege, or crash the system. Exposed builds are narrow: CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y must both be set, and because the affected source file failed to compile from v3.6.0 until after it was repaired past v4.4.0, the realistically exposed population is v3.5.0 builds plus downstream trees that locally patched that build breakage; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though it is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Null pointer dereference in Zephyr RTOS's MQTT-SN client subsystem allows a malicious or on-path network actor to crash any Zephyr device running an active MQTT-SN session by suppressing gateway keepalive responses. The defect is a missing assignment from the SYS_SLIST_PEEK_HEAD_CONTAINER macro in process_ping(): gw is never populated, remains NULL, and is subsequently dereferenced and passed to the memory slab allocator. The outcome is a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE) or silent slab free-list corruption on targets where address 0 is writable. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the trivial trigger condition and absence of MQTT-SN authentication make this straightforward for any party controlling or impersonating the client's gateway.
Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.
Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.
Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.
Kernel heap corruption via a double-fetch race condition in Zephyr RTOS's unprivileged socket syscall verifiers allows a local low-privilege attacker to achieve kernel privilege escalation or trigger a kernel denial of service. The flaw exists in z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() within subsys/net/lib/sockets/sockets.c, where msg_iovlen is read twice from live user memory - once to size the kernel heap shadow buffer and once as the iovec copy-loop bound - enabling a cooperating attacker thread to inflate the field between those reads and drive an out-of-bounds write into adjacent kernel heap objects. No public exploit has been identified at time of analysis; an upstream patch commit is confirmed available via the Zephyr project security advisory.
Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Heap-based out-of-bounds write in the Zephyr RTOS hawkBit OTA update client (versions 2.4.0 through <4.5.0) allows a malicious or compromised hawkBit update server to corrupt device heap memory by sending a crafted HTTP response body. The off-by-one flaw in response_json_cb() allocates exactly the response body length with no room for the NUL terminator, writing one byte past the heap object and corrupting adjacent allocator metadata. No public exploit identified at time of analysis, but the SSVC framework rates this as automatable and the trigger is deterministic in Zephyr v4.0.0 and later for any response body exceeding 1100 bytes - a size normal for hawkBit deployment metadata.
Stack buffer over-read and stray one-byte NUL write in Zephyr RTOS's experimental OCPP 1.6 client allow a malicious or compromised OCPP central server - or an on-path attacker exploiting the commonly unencrypted ws:// transport - to crash a connected embedded device by sending a crafted WAMP RPC frame with an oversized uid or action field. The vulnerable helper extract_string_field() uses strncpy() without guaranteeing NUL-termination, causing a subsequent strchr() call to scan unbounded into adjacent stack memory; a secondary defect in extract_payload() compounds this on maximal-length frames. No active exploitation has been confirmed by CISA KEV, but SSVC classification indicates publicly available proof-of-concept code, and EPSS sits at a low 0.19% (10th percentile), consistent with a niche embedded RTOS attack surface.
IPv6 packet forwarding in Zephyr RTOS versions 1.8.0 through 4.4.1 never decremented the hop limit on routed unicast packets, directly violating RFC 8200's mandatory loop-termination mechanism and enabling indefinite packet circulation in routing loops. Both forwarding branches of ipv6_route_packet() in subsys/net/ip - the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()) - were affected, with neither performing a hop-limit check nor decrement before calling net_send_data(). An on-path attacker who can induce or exploit a transient L3 routing loop converts it into a permanent forwarding storm, exhausting CPU and link bandwidth on the Zephyr forwarder and adjacent segments; no public exploit or active exploitation has been identified, and SSVC rates exploitation as none with a non-automatable attack.
Use-after-free in the Zephyr RTOS Bluetooth GATT client stack allows an adjacent Bluetooth peer acting as a GATT server to crash a Zephyr device or potentially redirect its execution by replying to a CCC-write with an ATT Error Response. The defect is a callback-ordering bug in gatt_write_ccc_rsp(): the API-documented termination signal notify(NULL) was emitted before subscribe(), so applications that free or recycle bt_gatt_subscribe_params in their termination handler dereference a dangling function pointer. No public exploit code or CISA KEV entry exists; a vendor patch commit is available but a specific tagged release version has not been confirmed.
Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.
Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.
Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.
Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.
Out-of-bounds read in the Zephyr RTOS LwM2M firmware-update pull client (lwm2m_pull_context.c) lets a malicious or compromised LwM2M management server - or an on-path attacker on a session without strong DTLS - leak adjacent device memory and crash devices by writing an over-long firmware Package URI (/5/0/1). Because the Firmware-Update object stores the URI in a 255-byte buffer but the pull context copies exactly 128 bytes into a fixed buffer with no NUL terminator, subsequent strlen-based parsing over-reads static memory that is then appended to outbound CoAP requests. It affects Zephyr 3.0.0 through 4.4.0 on the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path; there is no CISA KEV listing, EPSS is low (0.28%), and per the SSVC framework a proof-of-concept exists.
Kernel object corruption in Zephyr RTOS (v4.1.0 through v4.4.0) lets a deprivileged user thread on CONFIG_USERSPACE builds re-initialize a live k_pipe to which it has been granted access, orphaning threads already blocked on that pipe. Because z_impl_k_pipe_init() unconditionally resets the ring buffer and wait queues without accounting for pended waiters, a subsequent timeout or wake drives sys_dlist_remove() through dangling pointers, producing an attacker-influenced invalid kernel write, list corruption, lost wakeups, and silent data loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix hardens the k_pipe_init syscall verifier.
Local privilege escalation and kernel memory corruption in Zephyr RTOS on Xtensa SoCs (v3.7.0 through v4.4.0) built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, where arch_buffer_validate() fails open on an integer-overflow edge case, letting an unprivileged user thread trick the kernel into reading or writing arbitrary kernel/partition memory on its behalf. The flaw stems from a default-permit return value combined with a ROUND_UP address-space wrap that skips the MPU probe loop entirely, and it is not caught by the existing syscall-layer overflow guards. Vendor patch is available; no public exploit identified at time of analysis, and this is not in CISA KEV.
Kernel memory corruption in the Zephyr RTOS (versions v1.14.0 through v4.4.0) lets an unprivileged user-mode thread corrupt the kernel's dynamic object-tracking list across the userspace security boundary. The flaw is a use-after-free race (CWE-416) in the obj_list traversal, exploitable only on builds combining CONFIG_SMP, CONFIG_USERSPACE, and CONFIG_DYNAMIC_OBJECTS, and can yield privilege escalation or a kernel crash. No public exploit identified at time of analysis; a vendor patch is available.
Stack out-of-bounds write in the Zephyr RTOS network IP-parsing utility (parse_ipv4() in subsys/net/ip/utils.c) lets a crafted "a.b.c.d:port" address string with an overlong post-colon suffix overflow a 17-byte stack buffer with fully attacker-controlled length and contents, affecting Zephyr 1.9.0 through 4.4.0. Any application that resolves a network-influenced address string via the standard socket API (zsock_getaddrinfo/literal resolution), DNS server-string configuration, or the eswifi Wi-Fi DNS-response path is exposed, yielding at minimum denial of service and potentially control-flow hijack. No public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records proof-of-concept maturity and EPSS is low at 0.35%.
Out-of-bounds write in the WireGuard subsystem of Zephyr RTOS 4.4.0 lets a malicious or compromised WireGuard peer (or an on-path attacker driving an established session) corrupt memory by sending an oversized transport-data datagram. Because the flawed copy occurs before the Poly1305 authentication check, exploitation needs only a valid receiver session index rather than a valid authenticator, and reliably yields at least a remote denial of service on the target device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Zephyr project has published advisory GHSA-3wqm-wgx2-9367 and an upstream fix.
Non-atomic reference-count manipulation in the Zephyr RTOS net_buf library (lib/net_buf/buf.c) allows a double-free/use-after-free when a single buffer is shared and independently unref'd across concurrent contexts. Because buf->ref and the per-data-block ref_count were incremented/decremented with plain C operators despite the API being documented as self-synchronizing, two holders racing net_buf_unref() under SMP or single-core preemption can each conclude they hold the last reference, causing a double k_heap_free()/k_free() (heap-metadata corruption and UAF on heap-hardening poison) for heap/variable-data pools, or a double return to the pool free list for any pool type. All Zephyr releases through v4.4.0 are affected; no public exploit is identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets an adjacent attacker leak controller memory to the HCI host and potentially crash the device. A malicious CIS peer or a broadcaster the device is BIS-synced to sends a framed ISO PDU whose start-segment length field is 0-2, causing a uint8_t underflow (len-3 → 253-255) that copies up to ~255 bytes past the received PDU into an HCI ISO packet. Publicly available exploit code exists (SSVC: poc); it is not listed in CISA KEV, and EPSS is low at 0.17%, indicating no evidence of widespread active exploitation.
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious, spoofed, or on-path DNS server - or any LAN node when mDNS/LLMNR is enabled - return crafted truncated TXT or SRV records that leak residual receive-pool memory to the application, and in some configurations crash the device. It affects Zephyr v4.3.0 and v4.4.0; the SSVC framework records a proof-of-concept, so publicly available exploit code exists, though EPSS is low (0.20%, 10th percentile) and there is no public evidence of active exploitation. The disclosed data is bounded (~64 bytes for TXT, ~6 for SRV) and read-only, but can expose stale contents of prior DNS packets.
Arbitrary file read in the Zephyr RTOS HTTP server (subsys/net/lib/http) lets an unauthenticated remote client retrieve any readable file on the mounted filesystem volume by abusing path-traversal sequences against a registered static-filesystem resource. Affecting Zephyr v4.0.0 through v4.4.0 with CONFIG_FILE_SYSTEM enabled and a static-FS resource registered, the flaw stems from the raw request path being concatenated to the web root without canonicalization in both the HTTP/1 and HTTP/2 front-ends. No public exploit identified at time of analysis, but the bug is trivial to trigger (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and a vendor patch is available.
Memory corruption and denial of service in Zephyr RTOS (v4.0.0 through v4.4.0) arises in the BSD-sockets getaddrinfo() implementation, where a timed-out DNS query is retried without cancelling the prior query, leaving a callback holding a pointer into a stack frame that goes out of scope after getaddrinfo() returns. A network-delivered DNS response matched by its spoofable 16-bit transaction id, or the resolver's own delayed timeout work, then writes through that stale pointer, enabling crashes or reused-stack corruption. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation is gated by a timing/race window reflected in CVSS AC:H.
Out-of-bounds heap write in the Zephyr RTOS IP socket stack (recvmsg/insert_pktinfo) lets an unprivileged local userspace thread corrupt kernel-heap memory on builds using CONFIG_USERSPACE. Affecting Zephyr v3.6.0 through v4.4.0, the flaw is triggered when an application calls recvmsg() with an undersized ancillary (msg_control) buffer on a UDP/IP socket that has IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled and a datagram arrives. There is no public exploit identified at time of analysis and EPSS is low (0.12%), but the memory-corruption primitive gives full C/I/A impact locally.
Out-of-bounds write in Zephyr RTOS Bluetooth Classic Hands-Free Profile (HFP) parser allows an adjacent Bluetooth peer acting as an Audio Gateway to corrupt heap/static memory on devices with CONFIG_BT_HFP_HF enabled. A single malformed +CIND response sent during Service Level Connection setup can crash the Bluetooth host or corrupt adjacent connection state with no user interaction. No public exploit identified at time of analysis, and the upstream fix is available via commit cf7693a in the zephyrproject-rtos repository.
Denial of service (and potential limited memory corruption) in the Zephyr RTOS IPv6 networking stack (versions 3.3.0 through 4.4.0) stems from a use-after-free in the IPv6 Neighbor Discovery send paths, where per-interface ICMP statistics are updated by reading from a network packet after the stack has already freed it. Any unauthenticated on-link node can trigger the Neighbor Advertisement path simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 and CONFIG_NET_STATISTICS_PER_INTERFACE enabled, causing a freed slab block to be dereferenced. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); a vendor patch is available, and impact is largely limited to crashes/DoS with only theoretical limited memory corruption.
Use-after-free in Zephyr RTOS's ICMPv6 stack (v4.2.0-v4.4.0) allows an unauthenticated remote attacker to crash the networking stack and potentially corrupt memory by sending a standard ICMPv6 Echo Request or any IPv6 packet that elicits an ICMPv6 error response. Both `icmpv6_handle_echo_request()` and `net_icmpv6_send_error()` call `net_pkt_iface()` on a packet after transferring it to `net_try_send_data()`, which may synchronously or asynchronously free the packet's memory slab before the statistics update executes. When `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the stale interface pointer is written through (`iface->stats.icmp.sent++`), escalating the read UAF into an attacker-influenced memory write; no public exploit has been identified at time of analysis, but the trigger is a universally available IPv6 primitive.
Remotely triggerable denial of service in the Zephyr RTOS networking stack (versions 1.12.0 through 4.4.x) arises from a use-after-free in the IPv6 MLD code path, where mld_send() reads net_pkt_iface(pkt) after net_send_data() has already transferred packet ownership and the L2 driver freed it back to its memory slab. An unauthenticated attacker on the local link can elicit the vulnerable path by sending a crafted MLDv2 General Query, causing a NULL-pointer dereference crash or, in a narrow race, memory corruption via a stray statistics increment. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.
Remote code execution and denial of service in Zephyr RTOS HTTP server (versions 3.7.0 through 4.3.0) allow unauthenticated network attackers to corrupt stack memory by sending a crafted Sec-WebSocket-Key header during WebSocket upgrade. The flaw is a CWE-170 improper NUL-termination issue where a bounded copy fails to terminate the header buffer, causing strlen() and subsequent concatenation to read and write past stack bounds. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivially reachable attack surface make this a high-priority issue for any Zephyr deployment with CONFIG_HTTP_SERVER_WEBSOCKET enabled.
Memory corruption in the Zephyr RTOS eswifi socket offload driver (CVE-2026-1679) allows local code that can call the socket send API to overflow the fixed `eswifi->buf` buffer with an oversized payload, overwriting adjacent kernel memory in the class of unchecked buffer copies (CWE-120). The 7.8 base score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact but a strictly local attack surface that requires existing low-privilege code execution, a build that compiles in the eswifi offload path, and active use of the Inventek es-WiFi stack - there is no direct remote reach. Publicly available exploit code exists, yet EPSS is only 0.03% (10th percentile) and CISA's SSVC decision framework rates the issue non-automatable with partial technical impact, so this is a genuine but constrained local privilege and stability risk rather than an internet-facing emergency.
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on any device built with CONFIG_DNS_RESOLVER enabled, because the function caches the buffer's remaining tailroom once and reuses that stale value while appending decompressed DNS labels, allowing the terminating null byte to land past the end of the buffer. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but reactive: the target must itself initiate a name lookup and the attacker must be positioned to answer it - by operating a hostile or man-in-the-middle resolver or spoofing responses - so an adversary who cannot influence the device's DNS traffic cannot trigger the fault. Publicly available exploit code exists per the Zephyr GHSA advisory, though the vulnerability is not confirmed actively exploited (no CISA KEV listing) and the EPSS score is low at 0.05% (17th percentile). Our independent assessment agrees on the network/unauthenticated/High-integrity/High-availability profile but rates confidentiality impact Low rather than High.
Cross-session AES key confusion in the Zephyr RTOS Espressif ESP32 hardware crypto driver (drivers/crypto/crypto_esp32_aes.c, shipped in Zephyr 4.3.0 through 4.4.2) causes cipher operations to run under another session's key and direction instead of the key the caller installed. The driver advertises up to four independent cipher sessions, but the ESP32 AES peripheral has a single chip-global key/mode register set that aes_begin_session() programmed once, outside the aes_lock mutex, so a second session opened with a different key silently redirects every subsequent ECB, CBC or CTR operation from the first session, and the threaded pattern of begin-then-operate on separate sessions also races. Impact is cryptographic rather than memory corruption: plaintext the application believed protected under its own key may be encrypted or decrypted under a key the attacker knows or supplied, and encrypt/decrypt direction can be inverted; unauthenticated remote exploitation is constrained to custom applications on ESP32 hardware that hold two or more concurrent sessions with different keys, no stock Zephyr subsystem does so, and no public exploit has been identified at time of analysis (vendor fix merged, projected release 4.5.0).
A null-pointer dereference in the Zephyr Bluetooth Classic Hands-Free Profile Audio Gateway role can crash or hang the Bluetooth host stack when an RFCOMM connect fails after an SDP discovery has already linked the AG object into the SDP client's pending request list. Builds of Zephyr 4.4.0 through 4.4.2 with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG enabled and acting as an Audio Gateway are affected; a nearby BR/EDR device advertising an out-of-range RFCOMM channel (outside 0x01..0x1e) in its SDP Hands-Free record, which requires no pairing to read, deterministically forces the failure path. Impact is availability only - crash or hang of the Bluetooth stack, with no attacker-controlled write - and no public exploit code has been identified at time of analysis; the vendor fix is merged on main and v4.4-branch with the release carrying it forecast as 4.5.0.
A use-after-free in the Zephyr RTOS Bluetooth Classic host lets an adjacent, unauthenticated remote Audio Gateway crash or permanently hang the Bluetooth host thread on devices running 4.4.0 through 4.4.2 as an HFP Hands-Free unit (CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled). When bt_hfp_hf_connect() starts an SDP discovery and the following bt_rfcomm_dlc_connect() fails, the old code wiped the live HFP HF object with memset(), destroying a node still linked into the SDP client's request list and a possibly-queued work item; the host later dereferences the NULL pool and function pointers or walks a self-referential list. Impact is denial of service only (CVSS 5.3, AV:A/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-416) - the stray indirect call goes through an all-zero pointer the attacker does not control, so there is no code execution. No public exploit code was identified at time of analysis, but reachability depends on product application code that feeds a peer-discovered RFCOMM channel into bt_hfp_hf_connect(); the only in-tree caller is the shell sample, which limits exposure in default builds.
Predictable IPv6 interface identifiers in Zephyr RTOS 3.7.0 through 4.4.2 arise because the stack seeds the long-lived secret key behind RFC 7217 stable IIDs (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 temporary IIDs (gen_temporary_iid() in subsys/net/ip/ipv6_pe.c) with sys_rand_get(), an API documented as not cryptographically secure. On boards whose entropy driver selects CONFIG_ENTROPY_NEEDS_PRNG, that API resolves to the shared, invertible xoshiro128++ generator, and on entropy-device backends it silently degrades to k_cycle_get_32() samples on driver failure, so an attacker who passively observes on-wire values drawn from the same stream (ephemeral source ports, DNS query IDs, CoAP message IDs and tokens, DHCPv6 transaction IDs, WebSocket masking keys) can reconstruct the key and then compute a device's stable address for any prefix or link its temporary addresses across networks. Exploitation requires the default-off experimental options CONFIG_NET_IPV6_IID_STABLE or CONFIG_NET_IPV6_PE plus the affected PRNG-backed platform class, and no public exploit has been identified at time of analysis; impact is limited to address predictability and tracking (confidentiality of address-lifetime privacy only), with no memory-safety, integrity or availability effect. No public exploit identified at time of analysis, and the item is not tracked as confirmed actively exploited (CISA KEV).
Zephyr's Bluetooth host (subsys/bluetooth/host, versions 2.3.0 through 4.4.2) can be driven to permanently strand connection reservations: when CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1 and an application runs a directed and an undirected connectable extended advertising set on the same identity, an adjacent, unauthenticated attacker who freely chooses an initiator address mapping to the directed set's target causes the wrong bt_conn to be consumed, leaving the undirected set's reservation unreleasable. Each occurrence burns one CONFIG_BT_MAX_CONN slot until bt_disable() or reboot, and repeated attempts against applications that restart the directed set after each disconnect exhaust the pool so connectable advertising fails with -ENOMEM; the directed set also keeps advertising without a reservation, so genuine connections on it are dropped. Impact is availability only (no memory corruption or information disclosure), the vulnerable configuration is non-default on both Kconfig options, and no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Off-path DNS answer spoofing against the Zephyr DNS stub resolver (subsys/net/lib/dns, builds with CONFIG_DNS_RESOLVER) is made practical by a single static UDP source port that is bound once at resolver initialisation and reused for every query, so only the 16-bit transaction identifier varies - contrary to RFC 5452 section 9.2, which requires both to change. A remote attacker with UDP reachability to the device (same LAN, Wi-Fi or mesh segment, or a globally routable address) can learn that port from any observed query or by scanning for the one ephemeral port that stays silent instead of returning ICMP port-unreachable, then flood forged answers across the identifier space during a query window and race the legitimate server; a win makes the application resolve an attacker-chosen address, and with CONFIG_DNS_RESOLVER_CACHE enabled the forged record persists for its attacker-chosen TTL. Affected versions are >= 1.8.0 through <= 4.4.2; no public exploit code or active exploitation is confirmed, exploitation is probabilistic (the race must be won, and a predictable name must be in flight), and endpoints whose TLS certificates are validated are largely protected. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N (6.5), and vendor fixes are merged on main and the v4.4, v4.3 and v3.7 branches with a projected release in 4.5.0.
Predictable and reused DHCPv4 transaction identifiers in the Zephyr RTOS DHCP client (subsys/net/lib/dhcpv4/dhcpv4.c, versions 1.7.0 through 4.4.2) allow an attacker who has observed or learned a single identifier to forge BOOTP replies that the client accepts. Because parsing applies the router and DNS options to the interface before any state check, one accepted datagram can repoint the device's default gateway and resolvers at attacker-chosen addresses, redirecting its traffic; during RENEWING or REBINDING a forged ACK re-binds the lease with attacker parameters and a forged NAK drops the address and restarts configuration. Remote unauthenticated exploitation is scored CVSS 3.1 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L), the weakness is rated non-emergency on the available signals, and no public exploit code has been identified at time of analysis; fixes are merged upstream and in the v4.4, v4.3 and v3.7 branches, with 4.5.0 projected as the first fixed release.
Out-of-bounds write in the Zephyr ADXL345 RTIO streaming path (drivers/sensor/adi/adxl345/adxl345_stream.c) affects builds from 4.0.0 through 4.4.2 that enable CONFIG_ADXL345_STREAM on a board with an interrupt-wired ADXL345. The completion callback clamps the reported read length to the buffer actually granted by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets bounded by the device-reported entry count, so a truncated allocation causes up to 186 bytes written past the end of the block-pool buffer; a companion defect that failed to reset fifo_total_bytes at batch start can carry a stale offset into the next batch. Exposure is strictly local with high attack complexity and low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L, score 3.6); the written data is accelerometer sample content at the allocation tail, so the realistic outcome is corruption of neighbouring RTIO consumers' buffers or a crash rather than a controllable primitive. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and vendor fixes are merged on main and both release branches with a projected fixed release of 4.5.0.
Authorization bypass in Zephyr RTOS's experimental devmux pseudo-driver allows an unprivileged local user-mode thread to read or change which downstream device a multiplexer forwards to, letting it suppress, redirect, or flip console, log, and shell output. Only builds with CONFIG_USERSPACE=y, CONFIG_DEVMUX=y (and its CONFIG_DEVICE_MUTABLE dependency), and a zephyr,devmux devicetree node are affected, and the CVSS 3.1 score is 5.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. No public exploit identified at time of analysis, and the impact is bounded to the devicetree-fixed downstream device set with no memory-corruption path.
Out-of-bounds write in the Zephyr RTOS Nuvoton NPCX/NPCK eSPI Target-Attached-Flash driver lets an eSPI host that sends a flash write or RPMC OP1 request with an oversized 12-bit header length field push up to roughly 956 bytes of attacker-influenced data past a fixed 16-word buffer in .bss, and also causes up to 4 KB of adjacent controller SRAM to be programmed into SPI flash at a host-chosen address where the host can read it back. Only builds that explicitly enable CONFIG_ESPI_TAF on NPCX/NPCK silicon are exposed - no in-tree Zephyr board turns the option on by default - and the trigger requires host firmware or bus-level control of the eSPI link rather than ordinary host software, which is consistent with the assessed CVSS 6.3 vector (AV:L/PR:H). No public exploit code was identified at time of analysis, and the vendor has published a patched commit plus a GitHub security advisory.
A race condition in Zephyr RTOS's Infineon PSOC 6 BLESS Bluetooth HCI driver lets a connected BLE peer within radio range obtain small amounts of adjacent RAM (up to one HCI/ACL payload) or cause duplicate-dropped HCI packets, because the driver stores its outgoing TX descriptor in a file-scope static that is populated before the serialising semaphore is taken. Only builds using hci_infineon_psoc6_bless.c with CONFIG_BT_HCI_ACL_FLOW_CONTROL=y (the default on this driver's boards) and an application that returns -EINPROGRESS from its L2CAP recv callback and later calls bt_l2cap_chan_recv_complete() are realistically exposed, since that pattern moves the ACL buffer unref onto a preemptible thread that calls bt_send() directly, outside the cooperative TX work queue. Impact is bounded - the driver only reads through the descriptor, so there is no write primitive, no memory corruption, and the leaked bytes are not attacker-chosen; the assessed vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L (4.2). No public exploit identified at time of analysis; an upstream fix commit is published alongside a GitHub security advisory.
An out-of-bounds read in the Zephyr RTOS Bluetooth Classic A2DP host stack allows a paired BR/EDR peer to retrieve roughly 245 bytes of adjacent RAM from the victim device over the air. The bug is reachable only in firmware built with CONFIG_BT_CLASSIC and CONFIG_BT_A2DP that registers at least one non-SBC codec endpoint (MPEG1, MPEG2, ATRAC or vendor), because the SBC path pins the codec IE length to 4 bytes; the attacker must also have completed pairing since the AVDTP L2CAP channel enforces BT_SECURITY_L2 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Impact is limited to read-only disclosure of a bounded region of RAM with no write primitive or code execution, and no public exploit code was identified at time of analysis.
Double-completion of an RTIO submission in the Zephyr RTOS Broadcom AFBR-S50 time-of-flight sensor driver corrupts the RTIO submission pool, causing aliased submissions, writes through already-released RX buffers, and duplicate completions delivered to the application. Only firmware builds that compile in the driver for devicetree compatible brcm,afbr-s50 are affected; the error branch can be triggered by anyone within optical range of the sensor through harsh ambient light, sharp distance transitions, or SPI transfer errors, with no board contact and no authentication required (CVSS 3.1 5.2, AV:P/AC:L/PR:N, C:N/I:L/A:H). No public exploit code was identified at time of analysis, and because the attacker cannot control the corrupted content the realistic outcome is memory corruption and denial of service rather than directed code execution.
Denial of service in the Zephyr RTOS Bluetooth Classic Hands-Free Profile (HF role) allows a remote Audio Gateway peer to permanently leak entries from the fixed HFP TX buffer pool and then deadlock the Bluetooth RX thread, hanging the device until reboot. The bug lives in subsys/bluetooth/host/classic/hfp_hf.c: hfp_hf_disconnected() cancels work items and clears hf->acl but never drains the AT-command buffers queued on hf->tx_pending, and it leaves BT_HFP_HF_FLAG_CONNECTED set, while hfp_hf_create() memsets a reused HF slot without checking whether any work item is still pending or running. Only builds with CONFIG_BT_HFP_HF enabled are affected, and the attacker must reach an established, authenticated HFP session (paired/SSP devices have L2CAP authentication enforced before the RFCOMM channel is reachable), so this is an adjacent-range, authenticated-session availability issue rather than a drive-by one. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the per-cycle leak is trivially repeatable by any connected AG.
A permission-check flaw in Zephyr's RTIO syscall layer lets an unprivileged user-mode thread write into memory it is only permitted to read. In z_vrfy_rtio_cqe_get_mempool_buffer(), the two output parameters buff and buff_len are validated with K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(), so when CONFIG_USERSPACE and CONFIG_RTIO_SYS_MEM_BLOCKS are both enabled and the thread already holds an RTIO context grant, the kernel performs a pointer-sized and a 4-byte supervisor-mode store (a CWE-787 out-of-bounds write through mis-validated output pointers). Pointing those pointers at global read-only flash (.text/.rodata) causes a kernel fault handled by z_fatal_error() and the default fatal handler halts or reboots the device - a reliable denial of service - while targeting a K_MEM_PARTITION_P_RW_U_RO partition yields a partly attacker-controlled write that bypasses user-read-only protection; no data disclosure is possible because the read check still applies, and there is no public exploit identified at time of analysis, with exploitation strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, 6.1).
Denial of service in the Zephyr UpdateHub firmware-over-the-air client can be triggered by a malformed CoAP probe response that omits the sha256sum field, causing z_impl_updatehub_probe() to call strlen() on a NULL pointer. The issue affects Zephyr builds with UpdateHub enabled, especially the default plain-CoAP configuration without CONFIG_UPDATEHUB_DTLS, where an unauthenticated on-path, DNS-spoofing, or source-address-racing attacker can inject the response during automatic polling. Impact is availability only and target-dependent: systems that protect or leave unmapped address 0 halt in Zephyr's fatal handler, while classic Cortex-M targets with a readable vector table may merely reject the request; no public exploit has been identified at time of analysis.
An out-of-bounds read in the Zephyr RTOS STM32WBA IEEE 802.15.4 driver (drivers/ieee802154/ieee802154_stm32wba.c) lets an attacker within radio range of an STM32WBA-based device copy roughly 128 bytes of adjacent RAM into a network packet delivered to the networking stack. The flaw affects Zephyr 4.3.0 through 4.4.2 in the default production configuration (CONFIG_ASSERT=n), where the only length bound is compiled out; builds with CONFIG_ASSERT=y are not exploitable because the assertion would fire first. Impact is limited to a read-only information disclosure and oversized packet allocation in the RX thread - no code execution and no internet-reachable path - and no public exploit identified at time of analysis, with CVSS scored 4.2 (AV:A/AC:H/PR:N/UI:N).
Out-of-bounds write in the Zephyr CC1200 sub-GHz IEEE 802.15.4 driver lets an unauthenticated attacker within radio range transmit a frame whose first byte declares a PHY length above the IEEE 802.15.4 maximum of 127, driving an oversized net_buf allocation and a single SPI burst that can write up to 127 bytes past the end of the first 128-byte buffer fragment. The flaw affects builds that enable CONFIG_IEEE802154_CC1200 with a physically attached CC1200 radio in the driver's default variable-length mode (PKT_LEN = 0xFF), and exploitation is constrained by RF framing/timing requirements (CVSS 3.1 AV:A/AC:H/PR:N/UI:N, CWE-787), with the resulting overflow containing FIFO-underflow bytes so the realistic outcome is network-buffer-pool corruption and crashes rather than a controlled write. An upstream fix is available as a commit to verify_rxfifo_validity(), but no public exploit code or confirmed active exploitation was identified at time of analysis, and no independently confirmed tagged release containing the fix is documented here.
Integer underflow in the NXP KW41Z IEEE 802.15.4 receive path of Zephyr RTOS lets an attacker within radio range corrupt memory in the shared network-buffer pool from interrupt context. The driver samples the over-the-air PHY-header length byte from the ZLL IRQSTS register and subtracts the FCS length in a uint8_t, so a crafted frame advertising a length of one wraps to 255 bytes, which is copied into a single 128-byte net_buf fragment and overruns it by up to 127 bytes while also reading past the end of the radio's RX register array. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited; exploiting it requires RF proximity plus a timing race that the attacker must win by flooding length-one frames.
A use-after-free in Zephyr RTOS's Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) lets an adjacent Bluetooth peer crash or hang the entire device, producing a denial of service. The flaw is reachable only in builds where CONFIG_BT_HFP_AG is enabled (a profile Zephyr marks experimental and ships disabled by default) and where the application implements the optional asynchronous get_ongoing_call callback; a Hands-Free unit sends AT+CIND? during Service Level Connection setup, then tears down and re-opens the HFP RFCOMM DLC on the same ACL link within the ~10-second timeout window, deterministically reusing the same static pool slot while ag->ongoing_call_work is still armed and linked into the kernel timeout list. The repeated memset and k_work_init_delayable corrupt the kernel timeout dlist under an interrupts-locked announce loop, causing a fault or system hang; no attacker-controlled data is written, so code execution is not demonstrated. No public exploit code or in-the-wild exploitation was identified at time of analysis, and the exposed population is sharply limited by the non-default experimental configuration and physical Bluetooth proximity.
Memory corruption in Zephyr's Bluetooth Classic A2DP/AVDTP host stack allows an adjacent, paired BR/EDR peer to crash or hang the entire device by forcing a delayable work item to survive a session teardown. The attacker opens the AVDTP signalling channel, lets the local application issue an AVDTP procedure (the standard A2DP flow calls bt_a2dp_discover(), arming the 6-second AVDTP_TIMEOUT), then tears the channel down without responding and re-opens it within the remaining window, so that a2dp_get_connection() memsets the session while its timeout node is still linked into the kernel's global timeout list. Preconditions are narrow - the victim must run the experimental CONFIG_BT_A2DP option with the default CONFIG_TIMEOUT_BACKEND_DLIST backend and accept an encrypted (paired) BR/EDR link, which is why the assessed severity is a bounded denial-of-service rather than a remote pre-auth compromise; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Memory corruption in the Zephyr RTOS Bluetooth host ATT transmit path can be triggered by a peer in Bluetooth radio range whenever an application issues an ATT Signed Write Command over an unencrypted link. In chan_send(), the BT_ATT_OP_SIGNED_WRITE_CMD branch unrefers a net_buf it does not own after bt_smp_sign() fails (no local CSRK exists for the peer - a state the remote peer controls by pairing without requesting the signing key, pairing with No Bonding, staying unpaired, or keeping the link unencrypted); the callers honor the opposite ownership contract, so the already-freed buffer is re-queued, dereferenced and freed a second time, corrupting the ATT TX FIFO, deferred-destroy and pool free lists, while a related retry path can append a second 12-octet signature into a pooled buffer sized for one. Exploitation requires the deprecated, non-default CONFIG_BT_SIGNING build option plus a victim application that actually performs signed writes, giving CVSS 5.9 (AV:A/AC:H/PR:N, no confidentiality impact, high availability impact, low integrity impact); a vendor fix commit and GHSA-p3r4-qw98-j59m are available, and no public exploit was identified at time of analysis.
Zephyr RTOS Bluetooth Mesh nodes built with the default Access-layer delayed-message feature can be persistently muted by a mesh peer that is already provisioned into the same network and within Bluetooth radio range. By flooding the victim with requests that elicit segmented responses while withholding Segment Acknowledgments, the attacker forces bt_mesh_delayable_msg_manage() down an error path that returns a message context to neither the free nor the busy list, permanently shrinking the default four-entry context pool until every reply from Configuration Server, Health Server and application server models fails with -ENOMEM and is silently dropped. The impact is availability-only (CVSS 5.7, CWE-772, authenticated/PR:L and adjacent/AV:A per the assessed vector); the defect is cleared only by a reboot, the upstream fix is a committed source change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Availability loss in Zephyr RTOS Bluetooth Mesh affects nodes built with the default access-layer delayable message queue, where an unsynchronized race between the host RX thread and the system workqueue lets the handler touch a context slot that has already been purged. The attacker must be a provisioned mesh member - holding the NetKey and a bound AppKey - within Bluetooth radio range, who can control arrival rate, response size and destination address to exhaust the 4-entry context pool and 40-entry chunk pool and force the purge path; the trigger is a narrow, high-complexity race. Winning it produces a read-modify-write through a NULL-based pointer on the system workqueue thread, which on typical targets faults and aborts that thread (stopping all workqueue-driven functionality, including the mesh timing machinery) or resets the node, so impact is availability only - the write value and address are fixed, so there is no memory corruption or code execution path. Scoring is CVSS 3.1 4.8 (AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis, and there is no KEV listing.
The Bluetooth LE Controller in Zephyr RTOS can be faulted or have its receive PDU pool exhausted by a radio-range peer that drives the Link Layer PHY Update procedure into the retained-RX-node state and then sends an unexpected LL Control PDU before the update instant arrives; the invalid-PDU branches of llcp_lp_pu_rx() and llcp_rp_pu_rx() complete the procedure without releasing the retained node, so the procedure context is freed while the node stays out of the receive pool. In the default configuration (CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG both y) the violated invariant trips llcp_lr_check_done()/llcp_rr_check_done() and terminates in k_oops()/k_panic() from a single crafted PDU sequence, while on releases v3.4.0 through v3.7.x the assertion is never reached and each attempt silently leaks one PDU node from a pool that defaults to a single buffer (CONFIG_BT_CTLR_RX_BUFFERS=1), allowing a few reconnects to render Bluetooth inoperable until reboot. No pairing or encryption is required of the attacking peer (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit identified at time of analysis.
Denial of service affects Zephyr RTOS builds that include the Bluetooth Link Layer controller, where an over-the-air peer within Bluetooth radio range can trigger a retained RX node leak without pairing, bonding, or encryption. The peer sends a well-formed LL_CONNECTION_UPDATE_IND with a future instant (or reaches the same state as a central via LL_CONNECTION_PARAM_REQ, or through the local procedure via LL_REJECT_IND) and then, before that instant is reached, any other LL Control PDU such as LL_LENGTH_REQ; the invalid-PDU termination path completes the procedure without releasing the retained node, so llcp_rr_check_done() drops the last reference to it. With the default CONFIG_BT_CTLR_ASSERT_DEBUG enabled this produces an immediate fatal assertion in the controller, and with asserts disabled each occurrence permanently consumes a node from the small fixed RX pool until the receive path operates on NULL, with the impact being availability-only, limited to Bluetooth proximity, and persisting until reboot; no public exploit code was identified at time of analysis and there is no CISA KEV listing.