Zephyr RTOS: Four Vulnerabilities Disclosed Together, Affecting Drivers and Networking
Key findings • Four vulnerabilities disclosed for Zephyr RTOS on October 11, 2026, impacting drivers, networking, and syscalls. • High-severity flaws include issues in NXP entropy driver (CVE…
Key findings
- Four vulnerabilities disclosed for Zephyr RTOS on October 11, 2026, impacting drivers, networking, and syscalls.
- High-severity flaws include issues in NXP entropy driver (CVE-2026-19736) and fuel gauge syscall handlers (CVE-2026-19669).
- Medium severity in TCP ISN implementation (CVE-2026-19735) and Low in zbus proxy agent logging (CVE-2026-18418).
- Coordinated disclosure highlights potential weaknesses across core Zephyr RTOS components.
On October 11, 2026, a batch of four vulnerabilities was disclosed for the Zephyr Project RTOS, affecting core components including networking, drivers, and system call handling. The vulnerabilities, ranging in severity from Low to High, were disclosed simultaneously, highlighting potential weaknesses across different functional areas of the real-time operating system.
One of the high-severity vulnerabilities, CVE-2026-19736, resides in the NXP MCUX TRNG entropy driver. This flaw arises from the driver passing the caller's byte count directly to a vendor SDK routine, which on certain NXP i.MX RT parts, can lead to unexpected behavior due to how the SDK handles entropy rounding.
Another high-severity issue, CVE-2026-19669, impacts the user-mode syscall verifiers for fuel gauge drivers. Specifically, z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c incorrectly size variable-length arrays based on a caller-supplied length, potentially leading to buffer overflows or other memory corruption issues.
A medium-severity vulnerability, CVE-2026-19735, is found in the RFC 6528 initial-sequence-number (ISN) implementation within subsys/net/ip/tcp.c. The ISN derivation relies on a secret key and an uptime offset, but the initial call to secure random data generation is discarded, and a guard mechanism is improperly latched, potentially weakening the randomness of TCP ISNs.
Finally, a low-severity vulnerability, CVE-2026-18418, exists in the zbus proxy agent IPC backend. This issue involves improper logging of channel names for rejected inter-domain frames, where a plain %s conversion is used without guaranteeing the channel name is null-terminated, potentially leading to log corruption or information disclosure.
The coordinated disclosure of these four vulnerabilities underscores the importance of rigorous security auditing across all components of the Zephyr RTOS. Users are advised to review the specific details of each CVE and apply any available patches or mitigations provided by the Zephyr Project maintainers.
The batch of vulnerabilities was disclosed on October 11, 2026. The affected components include entropy drivers, networking stacks, system call handlers, and IPC backends. Users should prioritize updating to patched versions of the Zephyr RTOS to mitigate these risks.
The related news coverage from Vypr Intelligence mentions six vulnerabilities in total for the Zephyr Project on this date, including issues in Bluetooth and other networking components not detailed in this specific batch. However, it corroborates the low-severity logging issue in the zbus proxy agent (CVE-2026-18418).
This coordinated disclosure event serves as a reminder for developers utilizing the Zephyr RTOS to stay informed about security advisories and to promptly implement updates to maintain the integrity and security of their embedded systems. Further investigation into the specific impact of each vulnerability on different hardware platforms is recommended.