Zephyr RTOS: Six Network, Bluetooth, and Driver Vulnerabilities Disclosed Together
Six vulnerabilities disclosed in Zephyr RTOS from August 22-26, 2026, affecting networking, Bluetooth, and driver components with medium to low severity.
Key findings
- Six vulnerabilities disclosed in Zephyr RTOS between August 22-26, 2026, impacting networking, Bluetooth, and drivers.
- Medium severity flaws found in PTP message parsing (CVE-2026-13481) and syscall verification (CVE-2026-9728).
- Low severity issues in LoRaWAN protocol handling due to insufficient bounds checking (CVE-2026-13480, CVE-2026-13479).
- Bluetooth HAS service (CVE-2026-13213) and Infineon Wi-Fi driver (CVE-2026-12999) also affected by separate vulnerabilities.
- Vulnerabilities span network message handling, IPC, and driver resource management.
On August 26, 2026, a batch of six vulnerabilities affecting the Zephyr Project's real-time operating system (RTOS) was disclosed, with the earliest reported on August 22. These vulnerabilities, spanning network protocols, Bluetooth, and driver components, range in severity from low to medium. The disclosures highlight potential weaknesses in how the RTOS handles network messages, Bluetooth connections, and driver operations.
Several vulnerabilities stem from improper handling of network protocols. CVE-2026-13481, a medium-severity flaw, resides in the IEEE 1588 PTP management-message parser. The parser mishandles the PTP_MGMT_TIME management ID by not checking the data field's size before casting and reading it, potentially leading to issues. Similarly, two low-severity vulnerabilities were found in the LoRaWAN stack. CVE-2026-13480 (frag_transport.c) and CVE-2026-13479 (clock_sync.c) both involve the parsing of downlink command bytes without adequate validation of remaining payload length, risking out-of-bounds reads.
Other vulnerabilities impact core system components and drivers. CVE-2026-13213, a medium-severity issue in the Hearing Access Service (HAS) GATT server, arises from an unconditional connection callback registration, causing a security callback to run prematurely. Another medium-severity flaw, CVE-2026-9728, was found in the userspace syscall verifier z_vrfy_mbox_send(). This verifier directly read message data from live userspace memory without sufficient validation before forwarding the pointer to underlying functions. Lastly, CVE-2026-12999, a medium-severity vulnerability in the Infineon Airoc Wi-Fi driver, involves a resource leak in the transmit callback airoc_mgmt_send() when synchronous failure occurs during network data transmission.
While the provided information does not detail specific exploitation campaigns or threat actors, the clustering of these disclosures suggests a focused review or audit of the Zephyr RTOS components. The vulnerabilities affect various subsystems, including networking (PTP, LoRaWAN), Bluetooth audio, inter-process communication (IPC) via mailboxes, and Wi-Fi drivers.
Details regarding patches and affected versions were not explicitly provided in the disclosure information for this specific batch. Users of the Zephyr RTOS are advised to consult the official Zephyr Project advisories and security bulletins for the latest information on affected versions and available patches.
The coordinated disclosure of these six vulnerabilities underscores the importance of continuous security auditing within embedded operating systems like Zephyr. Users should prioritize applying any available updates and review their configurations, particularly for systems handling sensitive network protocols or Bluetooth communications. Further investigation into the specific impact of each vulnerability on different hardware implementations is recommended.