CVE-2026-10653

The Zephyr netbuf library lib/netbuf/buf.c manipulated both of its reference counts -- the per-header buf-ref and the per-data-block refcount at the start of each variable/heap data allocation -- with plain non-atomic C operators buf-ref++, if --buf-ref 0, if --refcount. The API is documented as...

CVE-2026-10653 Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref

The Zephyr netbuf library lib/netbuf/buf.c manipulated both of its reference counts -- the per-header buf-ref and the per-data-block refcount at the start of each variable/heap data allocation -- with plain non-atomic C operators buf-ref++, if --buf-ref 0, if --refcount. The API is documented as...

CVE-2024-6258

BT: Missing length checks of netbuf in rfcommhandledata...

CVE-2024-6258 BT: Missing length checks of net_buf in rfcomm_handle_data

BT: Missing length checks of netbuf in rfcommhandledata...

CVE-2024-6258

CVE-2024-6258 relates to Zephyr RTOS, where the RFCOMM data handling function rfcomm_handle_data lacks proper net_buf length checks, enabling a heap-based buffer overflow. Connected sources indicate Zephyr versions 3.6 and earlier are affected, with potential memory corruption or DoS as the outco...