Zephyr RTOS: Six Vulnerabilities Disclosed in Memory, Network, and System Call Handlers
Key findings • Six vulnerabilities disclosed in Zephyr Project RTOS between Oct 7-9, 2026. • Flaws include buffer overflows, memory allocation issues, and system call validation errors. •…
Key findings
- Six vulnerabilities disclosed in Zephyr Project RTOS between Oct 7-9, 2026.
- Flaws include buffer overflows, memory allocation issues, and system call validation errors.
- High-severity issues impact IEEE 802.15.4, Bluetooth Mesh, ARM64 MMU, and dynamic object creation.
- CVE-2026-19575 affects the device_deinit() system call handler.
- Patches are available; users should update to secure embedded systems.
On October 7-9, 2026, a batch of six vulnerabilities was disclosed in the Zephyr Project's real-time operating system (RTOS). These vulnerabilities, ranging in severity from medium to high, were discovered and reported by various researchers, with the disclosures clustered over a two-day period. The issues impact core components of the RTOS, including memory management, system calls, and network protocol handling, potentially affecting the security and stability of embedded devices running Zephyr.
Several vulnerabilities stem from improper handling of data lengths and buffer sizes, leading to potential overflows or incorrect memory access. CVE-2026-19186, a high-severity flaw, arises from an incorrect calculation of payload length in the IEEE 802.15.4 deciphering function, where a received frame shorter than expected could lead to an underflow. Similarly, CVE-2026-15894, another high-severity issue, involves a buffer overflow in the Bluetooth Mesh On-Demand Private Proxy solicitation handler due to a failure to bound the source length when copying data into a fixed-size buffer. CVE-2026-19571, a medium-severity vulnerability, concerns the ITE IT8xxx2 SHI host-command backend, which copies data before validating the protocol version and packet length, potentially allowing malformed commands to be processed.
Memory management and object handling are also affected. CVE-2026-19574, a high-severity flaw, impacts the ARM64 MMU back-end, where the allocation of Address Space Identifiers (ASIDs) could lead to reuse of ASIDs due to a wrapping counter, potentially causing memory domain conflicts. CVE-2026-19569, a high-severity vulnerability, lies in the dynamic object creation process, where calculations for backing allocations could wrap around due to a lack of unsigned overflow checks, leading to incorrect memory allocation sizes.
A critical system call handler was also found to be vulnerable. CVE-2026-19575, a high-severity flaw, resides in the user-mode verification handler for the device_deinit() system call. The validation check for the dev argument was insufficient, allowing improper handling of object types.
The Zephyr Project has addressed these vulnerabilities through updates. Users are advised to update to patched versions of the Zephyr RTOS to mitigate these risks. The timely disclosure and patching of these issues are crucial for maintaining the security posture of embedded systems that rely on the Zephyr Project for their operation.
This batch of vulnerabilities underscores the importance of rigorous security auditing in RTOS development, particularly concerning buffer management, memory allocation, and system call validation, as these are foundational elements for secure embedded systems.
CVE-2026-19186 CVE-2026-15894 CVE-2026-19571 CVE-2026-19574 CVE-2026-19569 CVE-2026-19575