EUVD-2026-58750

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

CVE-2026-12234

The CVE affects Zephyr’s userspace networking verification on zsock_sendmsg/zsock_recvmsg. The issue is a TOCTOU double-fetch: the verifier snapshots struct net_msghdr, yet later re-reads the live user memory to bound the loop, allowing a race where msg_iovlen can be inflated after the shadow buf...

EUVD-2026-55936

On the Zephyr ARM port, enabling the hardware FPU CONFIGFPU forces the "Floating point ABI" choice, which defaults to CONFIGFPHARDABI. Both FPHARDABI and FPSOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the...

CVE-2026-8718

CVE-2026-8718 affects Zephyr net sockets TLS with CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID and an established DTLS session. tls_opt_dtls_peer_connection_id_value_get() passes optval to mbedtls_ssl_get_peer_cid() without ensuring the destination buffer is large enough (MBEDTLS_SSL_CID_OUT_LEN_MAX, de...

CVE-2026-8718 Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...