Zephyr Project: Six Vulnerabilities Disclosed in Bluetooth, Networking, and Input Components
Key findings • Six vulnerabilities disclosed for the Zephyr Project on October 11, 2026, spanning Bluetooth, networking, and input drivers. • High severity flaws include issues in Bluetooth L…
Key findings
- Six vulnerabilities disclosed for the Zephyr Project on October 11, 2026, spanning Bluetooth, networking, and input drivers.
- High severity flaws include issues in Bluetooth LE host data handling (CVE-2026-19935) and IPv6 routing (CVE-2026-19577).
- Medium severity vulnerabilities affect Bluetooth Link Layer procedures (CVE-2026-19739, CVE-2026-19738) and the Goodix input driver (CVE-2026-19576).
- A Low severity issue in the zbus proxy agent involves improper logging of channel names (CVE-2026-18418).
- The coordinated disclosure highlights potential weaknesses in core Zephyr RTOS components.
On October 11, 2026, a batch of six vulnerabilities was disclosed for the Zephyr Project, a real-time operating system. These vulnerabilities span various components of the Zephyr Project, including its Bluetooth stack and networking subsystems, with severity ratings ranging from Low to High. The disclosures highlight potential weaknesses in how the system handles network packets, Bluetooth connections, and input device data.
Several vulnerabilities stem from improper handling of data within the Bluetooth stack. CVE-2026-19935, a High severity vulnerability, involves the Bluetooth LE host's queueing of received L2CAP connection-oriented channel data for deferred processing. This could lead to issues when the channel uses a dynamic PSM. Similarly, CVE-2026-19739 and CVE-2026-19738, both Medium severity, relate to the Bluetooth Link Layer control procedure. These flaws involve the retention of received nodes during connection update and CIS creation procedures, potentially leading to unexpected behavior or data handling errors.
The networking subsystem is also affected. CVE-2026-19577, rated High, arises from a failure in net_route_ipv6_packet() to check for a valid link-layer address in the neighbor cache before resolving it. This could allow for issues when dealing with unresolved neighbors.
Beyond Bluetooth and networking, other components are impacted. CVE-2026-19576, a Medium severity vulnerability, is found in the Goodix GT9xx input driver. It involves the improper use of a touch point count, which could lead to an out-of-bounds read when processing touch data. Lastly, CVE-2026-18418, a Low severity vulnerability, exists in the zbus proxy agent IPC backend. This flaw involves logging a channel name with a plain %s conversion, which could potentially lead to information disclosure if not handled carefully.
The full impact of these vulnerabilities depends on the specific configurations and usage of the Zephyr Project in various embedded systems. Users are advised to consult the official Zephyr Project advisories for detailed mitigation steps and affected versions. The coordinated disclosure of these six CVEs on the same day suggests a focused review or audit of the Zephyr Project's codebase, emphasizing the importance of regular security assessments for embedded operating systems.
As of the disclosure, no specific threat actors or widespread exploitation campaigns have been publicly linked to this batch of vulnerabilities. However, the nature of these flaws, particularly those in the Bluetooth and networking stacks, could be exploited by attackers to disrupt device operations, gain unauthorized information, or potentially achieve further system compromise depending on the context of the embedded device.
The Zephyr Project community and its maintainers are responsible for addressing these vulnerabilities. Patches and updated versions are expected to be released to rectify these issues. Users of the Zephyr Project should prioritize applying these updates as soon as they become available to secure their embedded systems against potential threats. The timely patching of these vulnerabilities is crucial for maintaining the security and integrity of devices running the Zephyr RTOS.
This batch of disclosures underscores the ongoing need for vigilance in the embedded systems security landscape. As devices become more interconnected, vulnerabilities in foundational software like operating systems can have far-reaching consequences. Continuous security auditing, prompt patching, and awareness of potential risks are essential for developers and users of the Zephyr Project and similar embedded platforms. The coordinated nature of this disclosure highlights the proactive efforts by security researchers and the Zephyr Project to identify and address security weaknesses.