Zephyr RTOS: High-Severity Virtio Flaw and Two Driver Bugs Disclosed Together
Three Zephyr RTOS vulnerabilities disclosed, including a high-severity virtio driver flaw allowing memory corruption and two medium-severity issues in Bluetooth and Wi-Fi drivers.
Key findings
- High severity virtio driver vulnerability (CVE-2026-13212) allows memory corruption via invalid descriptor IDs.
- Medium severity Bluetooth HAS vulnerability (CVE-2026-13213) due to unconditional callback registration.
- Medium severity Infineon Airoc Wi-Fi driver vulnerability (CVE-2026-12999) causes resource leaks on transmission failure.
- Batch of three vulnerabilities disclosed together impacts core Zephyr RTOS components.
On August 24, 2026, a batch of three vulnerabilities affecting the Zephyr RTOS was disclosed, with the earliest reported on August 22. The vulnerabilities, identified as CVE-2026-13213, CVE-2026-13212, and CVE-2026-12999, impact different components of the real-time operating system, including its Bluetooth audio handling, virtio driver, and Wi-Fi driver. The most severe of these, CVE-2026-13212, is rated as High severity due to a flaw in the virtio driver's handling of descriptor chain IDs, potentially allowing a virtio device to corrupt memory by writing an invalid ID into the used ring. This could lead to denial-of-service or even arbitrary code execution.
CVE-2026-13213, a Medium severity vulnerability, resides in the Hearing Access Service (HAS) GATT server within the Bluetooth audio subsystem. It stems from an unconditional registration of a connection callback, causing the security_changed() function to execute for every connection security establishment, even before the application has properly registered the HAS service. This premature execution could lead to unexpected behavior or crashes within the Bluetooth audio service.
Another Medium severity vulnerability, CVE-2026-12999, affects the Infineon Airoc Wi-Fi driver. The vulnerability lies in the transmit callback function, airoc_mgmt_send(), where a network buffer is allocated for every outbound packet. However, when the underlying WHD library encounters a synchronous failure during transmission and does not take ownership of the buffer, it can lead to a resource leak. This could potentially exhaust the buffer pool, impacting the Wi-Fi driver's ability to send further network data.
The disclosures highlight potential weaknesses in how Zephyr handles external device interactions and network protocols. The virtio driver vulnerability (CVE-2026-13212) is particularly concerning due to its potential for memory corruption and code execution, underscoring the importance of robust input validation in driver code. Similarly, the Bluetooth and Wi-Fi driver issues (CVE-2026-13213 and CVE-2026-12999) point to the need for careful management of callbacks and resource allocation in network-related services.
Users of the Zephyr RTOS are advised to review the specific details of each vulnerability and apply any available patches or workarounds provided by the Zephyrproject maintainers. Given the span of the disclosure, it is crucial to assess the impact of these vulnerabilities on systems utilizing the affected components, particularly those with high-security requirements or exposed to untrusted network traffic. Continued vigilance and prompt application of security updates are essential for maintaining the integrity and security of embedded systems running Zephyr.