Zephyr RTOS: Five Vulnerabilities Disclosed, Including High-Severity Virtio Flaw
Key findings • Five vulnerabilities disclosed together in Zephyr RTOS, including a high-severity virtio driver flaw. • Two vulnerabilities in the ext2 filesystem driver related to bitmap and …
Key findings
- Five vulnerabilities disclosed together in Zephyr RTOS, including a high-severity virtio driver flaw.
- Two vulnerabilities in the ext2 filesystem driver related to bitmap and superblock validation.
- OCPP 1.6 client vulnerable due to improper handling of server-supplied UID.
- Virtio PCI driver fails to adequately validate capability length during initialization.
- CVE-2026-13212 allows memory corruption via invalid descriptor IDs in the virtio driver.
On August 25, 2026, a batch of five vulnerabilities affecting the Zephyr RTOS was disclosed, with the earliest reported on August 24. The vulnerabilities, identified as CVE-2026-13478, CVE-2026-13217, CVE-2026-13216, CVE-2026-13215, and CVE-2026-13212, impact different components of the real-time operating system, including its filesystem drivers, network protocols, and virtio drivers.
The disclosed vulnerabilities include issues within the Zephyr ext2 filesystem driver, the OCPP 1.6 client, and the virtio PCI driver.
Filesystem Driver Vulnerabilities
Two vulnerabilities were found in the Zephyr ext2 filesystem driver. CVE-2026-13478, a medium-severity issue, arises from the driver's failure to properly validate the on-disk block bitmap. Specifically, the ext2_init_fs() function passes an incorrectly calculated fs_blocks value to ext2_bitmap_count_set(), which then misinterprets the value as a bit count and reads an excessive amount of data from the bitmap.
Another medium-severity vulnerability, CVE-2026-13215, also affects the ext2 filesystem driver. This flaw stems from a lack of validation for the s_log_block_size field in the on-disk superblock when mounting a filesystem. While other critical fields like the magic number and revision are checked, s_log_block_size is not bounds-checked, potentially leading to issues when the filesystem is mounted.
Network and Virtio Driver Vulnerabilities
CVE-2026-13217, a medium-severity vulnerability, impacts the OCPP 1.6 client. The client reconstructs session handles and PDU IDs from the uid field of a CALLRESULT message. In the ocpp_process_server_msg() function, the code uses atoi(strtok_r(uid, "-", &tmp)) without validating the return value of strtok_r. This can lead to issues when the server-supplied uid is empty or lacks the expected delimiter.
The most severe vulnerability disclosed, CVE-2026-13212, is a high-severity flaw in the Zephyr virtio driver. This issue allows for memory corruption due to the driver not validating the descriptor-chain head ID provided by the virtio device. In the virtio_isr() function, the id written by the device into the used ring is directly used as an index into the recv_cbs[] and desc[] arrays, which are allocated with a size exactly matching the number of descriptors. This lack of validation can be exploited to corrupt memory.
Additionally, CVE-2026-13216, a medium-severity vulnerability, was found in the virtio PCI driver. During driver initialization, the driver parses a device's PCI capability list. In virtio_pci_read_cap(), the device-supplied capability length (cap_len) is only checked with an assertion, which is insufficient for robust security.
Response and Mitigation
All five vulnerabilities were disclosed on August 24-25, 2026. Users of the Zephyr RTOS are advised to update to the latest available versions to patch these issues. Specific version information for the patches is not detailed in the provided information, but it is critical for users to apply updates as soon as they become available. The batch of vulnerabilities highlights the importance of thorough validation of external inputs and device-provided data within embedded operating systems.
The disclosure of these vulnerabilities, particularly the high-severity flaw in the virtio driver, underscores the need for continuous security auditing and timely patching of embedded systems. Users should monitor Zephyr RTOS security advisories for any further updates or recommendations.