Zephyr Project: Four Vulnerabilities Disclosed, Including WireGuard and Arm64 Flaws
Four vulnerabilities, including two high-severity flaws, were disclosed for the Zephyr Project, affecting its networking stack and arm64 architecture.
Key findings
- Four vulnerabilities disclosed for Zephyr Project on October 23, 2026, impacting networking and arm64 architecture.
- High-severity flaws include an unauthenticated endpoint update in WireGuard and an MMU TLB invalidation issue on arm64.
- Medium-severity issues affect the DNS stub resolver's port binding and the DHCPv4 client's transaction identifier.
- The vulnerabilities span network services and low-level architecture components within the RTOS.
On October 23, 2026, a batch of four vulnerabilities was disclosed for the Zephyr Project, an open-source real-time operating system. The vulnerabilities, with CVSS scores ranging from medium to high, impact various networking and architecture components of the RTOS. The disclosures were made on the same day, indicating a coordinated release of security information.
Two of the vulnerabilities reside in the networking subsystem. CVE-2026-79981, a medium-severity issue, affects the DNS stub resolver. It was found that the resolver binds a UDP socket to port 0 for each configured server, allowing the stack to pick an ephemeral port. This could lead to unintended consequences in how DNS queries are handled. Another networking vulnerability, CVE-2026-79980, also rated medium, impacts the DHCPv4 client. This flaw lies in the maintenance of the transaction identifier (XID), which was used as a counter instead of a per-transaction random value, potentially enabling replay attacks or other network manipulation.
The batch also includes two high-severity vulnerabilities. CVE-2026-79977, with a CVSS score of 8.2, affects the WireGuard VPN service. The vulnerability allows an unauthenticated peer to update its endpoint by sending a message that the service could not authenticate. This could enable an attacker to manipulate peer endpoints and potentially intercept or redirect traffic. The second high-severity issue, CVE-2026-79979, impacts the arm64 MMU backend. It was discovered that the TLB invalidation mechanism in the arm64 architecture incorrectly targeted only ASID 0 (kernel page tables) and global entries, potentially leading to incomplete cache coherency and security implications on affected systems.
The disclosures highlight potential weaknesses in the network stack and architecture-specific implementations within the Zephyr Project. Users of the Zephyr RTOS are advised to review the details of each CVE and apply any available patches or mitigations. The coordinated disclosure of these vulnerabilities on a single day suggests a focused effort to address these security concerns within the project.
Further investigation into the specific impact and exploitability of each vulnerability is recommended for organizations relying on the Zephyr Project for their embedded systems. Staying informed about security advisories and updates from the Zephyr Project maintainers is crucial for maintaining a secure operating environment.