zephyr
Source repositories
CVEs (74)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-8798 | Hig | 0.49 | 7.5 | 0.00 | Dec 16, 2024 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. | ||
| CVE-2024-6259 | Hig | 0.49 | 7.6 | 0.01 | Sep 13, 2024 | BT: HCI: adv_ext_report Improper discarding in adv_ext_report | ||
| CVE-2024-4785 | Hig | 0.49 | 7.6 | 0.00 | Aug 19, 2024 | BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero | ||
| CVE-2026-12364 | Hig | 0.48 | 8.4 | 0.00 | Aug 14, 2026 | The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation z_impl_z_log_msg_static_create()… | ||
| CVE-2023-6881 | Hig | 0.47 | 7.3 | 0.00 | Feb 29, 2024 | Possible buffer overflow in is_mount_point | ||
| CVE-2026-12633 | Hig | 0.46 | 8.1 | 0.00 | Aug 19, 2026 | The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Router Advertisements. In handle_ra_6co() the 8-bit context_len field is taken directly from the packet and was never bounded to the RFC… | ||
| CVE-2025-10456 | Hig | 0.46 | 7.1 | 0.00 | Sep 19, 2025 | A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not… | ||
| CVE-2026-18414 | Hig | 0.44 | 7.8 | 0.00 | Sep 28, 2026 | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must… | ||
| CVE-2026-17052 | Hig | 0.44 | 7.8 | 0.00 | Sep 21, 2026 | The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a… | ||
| CVE-2026-12234 | Hig | 0.44 | 7.8 | 0.00 | Aug 12, 2026 | The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-side copy with k_usermode_from_copy(), but then re-read the still-live user struct for subsequent… | ||
| CVE-2026-10669 | Hig | 0.44 | 7.8 | 0.00 | Jul 14, 2026 | On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return… | ||
| CVE-2026-15891 | Hig | 0.42 | 7.5 | 0.00 | Sep 13, 2026 | The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression… | ||
| CVE-2026-10680 | Hig | 0.42 | 7.6 | 0.00 | Jul 21, 2026 | The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length… | ||
| CVE-2025-12035 | Med | 0.42 | 6.5 | 0.00 | Dec 15, 2025 | An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic. | ||
| CVE-2025-12890 | Med | 0.42 | 6.5 | 0.00 | Nov 7, 2025 | Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it. | ||
| CVE-2024-3332 | Med | 0.42 | 6.5 | 0.00 | Jul 3, 2024 | A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device | ||
| CVE-2024-6444 | Med | 0.41 | 6.3 | 0.00 | Oct 4, 2024 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. | ||
| CVE-2024-6443 | Med | 0.41 | 6.3 | 0.01 | Oct 4, 2024 | In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty. | ||
| CVE-2024-6442 | Med | 0.41 | 6.3 | 0.00 | Oct 4, 2024 | In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow. | ||
| CVE-2026-11368 | Hig | 0.39 | 7.1 | 0.00 | Aug 4, 2026 | The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the… |
- risk 0.49cvss 7.5epss 0.00
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
- risk 0.49cvss 7.6epss 0.01
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
- risk 0.49cvss 7.6epss 0.00
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
- risk 0.48cvss 8.4epss 0.00
The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation z_impl_z_log_msg_static_create()…
- risk 0.47cvss 7.3epss 0.00
Possible buffer overflow in is_mount_point
- risk 0.46cvss 8.1epss 0.00
The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Router Advertisements. In handle_ra_6co() the 8-bit context_len field is taken directly from the packet and was never bounded to the RFC…
- risk 0.46cvss 7.1epss 0.00
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not…
- risk 0.44cvss 7.8epss 0.00
The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must…
- risk 0.44cvss 7.8epss 0.00
The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a…
- risk 0.44cvss 7.8epss 0.00
The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-side copy with k_usermode_from_copy(), but then re-read the still-live user struct for subsequent…
- risk 0.44cvss 7.8epss 0.00
On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return…
- risk 0.42cvss 7.5epss 0.00
The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression…
- risk 0.42cvss 7.6epss 0.00
The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length…
- risk 0.42cvss 6.5epss 0.00
An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
- risk 0.42cvss 6.5epss 0.00
Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.
- risk 0.42cvss 6.5epss 0.00
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
- risk 0.41cvss 6.3epss 0.00
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
- risk 0.41cvss 6.3epss 0.01
In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
- risk 0.41cvss 6.3epss 0.00
In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.
- risk 0.39cvss 7.1epss 0.00
The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the…
Page 2 of 4