CVE-2026-87043

The Zephyr RTOS entropy-device random number generator in subsys/random/random_entropy_device.c is vulnerable to an uninitialized read due to premature error handling. When device_is_ready() fails, rand_get() returns -ENODEV early, skipping the system-timer fallback. Because the sys_rand_get() sy...

EUVD-2026-97114

The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256uniquekey || four-tuple plus a uptime-derived offset, where uniquekey is a 128-bit secret filled once by syscsrandget. The return value of that call was discarded and the once guard was...