Zephyr RTOS: Four Network and Subsystem Vulnerabilities Disclosed Together
Four vulnerabilities, ranging from medium to low severity, were disclosed in the Zephyr RTOS on August 31, 2026, impacting its networking and subsystem components.
Key findings
- Four vulnerabilities disclosed in Zephyr RTOS on August 31, 2026, affecting networking and subsystems.
- CVE-2026-14697: Potential improper handling of network traffic due to premature return in IPv6 Neighbor Solicitation.
- CVE-2026-14696: Issue in Ethernet bridging logic potentially leading to incorrect frame processing.
- CVE-2026-14368: Buffer overflow vulnerability in LwM2M JSON content formatter.
- CVE-2026-14367: Low-severity race condition in the I3C IBI subsystem due to unsynchronized work node management.
On August 31, 2026, a batch of four medium- and low-severity vulnerabilities was disclosed in the Zephyr RTOS, a project focused on creating a real-time operating system for connected, resource-constrained devices. The vulnerabilities, all disclosed within a one-hour window, affect various networking and subsystem components of the RTOS.
One vulnerability, CVE-2026-14697, resides in the net_ipv6_send_ns() function within subsys/net/ip/ipv6_nbr.c. This function is responsible for sending Neighbor Solicitation messages in IPv6. The issue arises when a data packet is pending for an unresolved neighbor, and that neighbor already has a pending queue. In this scenario, the function appends the data packet and returns prematurely, potentially leading to improper handling of network traffic.
Another vulnerability, CVE-2026-14696, impacts the Ethernet bridging functionality. In subsys/net/l2/ethernet/bridge/bridge_input.c, the eth_bridge_input_process() function determines how frames received on a bridge member interface are processed. When frames need to be delivered to the local stack, the code calls eth_bridge_handle_locally(). The vulnerability lies in how this function handles certain frames, potentially leading to incorrect processing.
CVE-2026-14368, a medium-severity vulnerability, is found in the LwM2M JSON content formatter's get_string() function in subsys/net/lib/lwm2m/lwm2m_rw_json.c. This function copies a parsed JSON string into a caller-supplied buffer. The vulnerability occurs because the length check if (string_length > buflen) incorrectly allows a string whose length is exactly equal to the buffer size. After memcpy() fills the entire buffer, the code attempts to NUL-terminate the string at buf[string_length], which is out of bounds, leading to a buffer overflow.
Finally, CVE-2026-14367, a low-severity vulnerability, affects the I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c. This subsystem uses statically allocated work nodes managed by a plain sys_slist_t for its free list, which lacks synchronization. This can lead to race conditions when multiple threads attempt to allocate or free work nodes concurrently, potentially causing data corruption or unexpected behavior.
These vulnerabilities highlight potential weaknesses in the network stack and data handling mechanisms within the Zephyr RTOS. Users of the Zephyr RTOS are advised to review the specific component affected by each CVE and apply any available patches or mitigations provided by the Zephyrproject Rtos maintainers.
The disclosed vulnerabilities do not appear to be linked to any specific threat actor or campaign, and there is no immediate information regarding active exploitation in the wild. The focus remains on the technical details of each flaw and the necessary steps for remediation.
The Zephyrproject Rtos team is expected to release patches to address these issues. Users should monitor official advisories for the affected versions and recommended update paths. Given the nature of the vulnerabilities, which range from potential buffer overflows to race conditions in network handling, prompt attention is warranted to ensure the security and stability of embedded systems running Zephyr.
The batch of vulnerabilities underscores the importance of rigorous security auditing for real-time operating systems, especially those used in connected devices where network-related flaws can have significant implications. Continued vigilance and timely updates are crucial for maintaining the integrity of these systems.