1755 matches found
CVE-2026-12630
In Zephyr's 6LoWPAN stack, get_ihpc_inlined_size() in subsys/net/ip/6lo.c indexes a 13-entry table with a 4-bit value (0-15) from the incoming IPHC dispatch word. Reserved indices 13-15 are unchecked, causing an out-of-bounds read that drives further buffer dereference and size_t underflow before...
PT-2026-76712
Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in get ihpc inlined size subsys/net/ip/6lo.c. The destination inline size is looked up in da inline size table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPH...
PT-2026-76715
The flash copy system call is verified by z vrfy flash copy in drivers/flash/flash util.c. On builds with CONFIG USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer K SYSCALL MEMORY WRITE and passed the two...
CVE-2026-12366
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
CVE-2026-12365
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
CVE-2026-12364
The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...
EUVD-2026-58752
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
CVE-2026-12366
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
CVE-2026-12366
Summary: CVE-2026-12366 in Zephyr describes a use-after-free in the dynamic object disposal path for kernels objects. When a user-thread holds the last permission on a timer (K_OBJ_TIMER) and frees it, the timer’s memory is released without cancelling its embedded _timeout node from the global _t...
EUVD-2026-58751
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
CVE-2026-12365
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
CVE-2026-12365
CVE-2026-12365 describes a kernel-use-after-free in Zephyr’s second-generation work queue (kernel/work.c) related to delayable work timeouts. If a delayable work item’s timeout has been dequeued and its handler work_timeout() is in flight, a concurrent cancellation can race, allowing a freed slot...
CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
EUVD-2026-58750
The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...
CVE-2026-12364 Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service
The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...
CVE-2026-12364
The CVE-2026-12364 issue affects the Zephyr kernel’s user-space syscall verifier z_vrfy_z_log_msg_static_create(). The verifier failed to enforce K_SYSCALL_* checks when forwarding source, desc, package, and data to z_impl_z_log_msg_static_create(), allowing an attacker-controlled user-space thre...
CVE-2026-12364
The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...