Zephyr RTOS: Eight Vulnerabilities Disclosed in Power Management, Drivers, and Bluetooth Stack
Eight vulnerabilities affecting the Zephyr Project RTOS were disclosed between October 19-21, 2026, with severities ranging from medium to high.
Key findings
- Eight vulnerabilities disclosed for Zephyr Project RTOS between Oct 19-21, 2026.
- High-severity flaws include race conditions and un-cleared register states.
- Medium-severity issues affect drivers, Bluetooth, and system call handling.
- Vulnerabilities span memory management, buffer handling, and concurrency.
- Patches are available; users advised to update to the latest Zephyr RTOS versions.
On October 21, 2026, a batch of eight vulnerabilities affecting the Zephyr Project RTOS was disclosed, spanning a disclosure window from October 19 to October 21. The vulnerabilities, with CVSS scores ranging from medium to high, impact various subsystems including power management, flash drivers, Bluetooth, and inter-process communication. The disclosures highlight potential issues in how the RTOS handles memory, buffer management, and system calls across different hardware architectures and configurations.
Several vulnerabilities stem from improper handling of data and memory within specific drivers and subsystems. CVE-2026-79976, a high-severity flaw, involves an un-cleared register state in the MCTP-over-I2C+GPIO target binding, potentially leading to incorrect operations. Similarly, CVE-2026-78119, a medium-severity issue, arises from the Nuvoton NPCX eSPI driver's handling of Target-Attached-Flash requests, where an incorrect length field could lead to buffer overflows. Another medium-severity vulnerability, CVE-2026-19595, was found in the RTIO syscall verifier, which incorrectly used a memory read validation for an output parameter, potentially leading to memory corruption.
Concurrency and synchronization issues were also present in the disclosed batch. CVE-2026-78118, a high-severity vulnerability, describes a race condition in the kernel's wait queue handling on SMP systems, where the scheduler spinlock was not held during wait-queue mutations, potentially leading to instability. CVE-2026-77684, a medium-severity Bluetooth issue, involves the failure to release AT command buffers in the Bluetooth Classic Hands-Free Profile HF role when the RFCOMM DLC disconnects, leading to resource leaks.
Other vulnerabilities include CVE-2026-78117, a medium-severity flaw in the Infineon PSOC 6 BLESS HCI driver where outgoing HCI packet descriptors were stored in a file-scope variable, potentially leading to data corruption. CVE-2026-79947, also medium-severity, concerns a double-completion issue in the Broadcom AFBR-S50 time-of-flight sensor driver when sensor data evaluation fails. Lastly, CVE-2026-19947, a medium-severity vulnerability, relates to the device multiplexer pseudo-driver, where user-mode verifiers did not properly validate system calls when CONFIG_USERSPACE was enabled.
The disclosures indicate that patches are available for these issues, with fixes likely integrated into recent Zephyr Project RTOS releases. Users are advised to consult the official Zephyr Project advisories and update to the latest stable versions to mitigate these risks. The breadth of affected subsystems suggests a need for thorough review and testing of system configurations, particularly those involving inter-process communication, Bluetooth, and specialized hardware drivers.
This batch of vulnerabilities underscores the ongoing security efforts within the Zephyr Project community to identify and address potential weaknesses in its codebase. Continued vigilance and timely application of patches remain critical for maintaining the security and integrity of embedded systems built upon the Zephyr RTOS.
CVE-2026-79976 CVE-2026-78119 CVE-2026-78118 CVE-2026-78117 CVE-2026-79947 CVE-2026-19947 CVE-2026-77684 CVE-2026-19595