783 matches found
CVE-2026-12365
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
CVE-2026-12364
The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...
CVE-2026-12366
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
EUVD-2026-58751
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
CVE-2026-12365
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
EUVD-2026-58750
The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...
CVE-2026-12364 Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service
The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...
PT-2026-72076
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The user-space system-call verifier z vrfy z log msg static create in subsys/logging/log msg.c fails to perform mandatory K SYSCALL checks, acting as a...
CVE-2026-12234
The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...
CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write
The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...
CVE-2026-12234
The CVE affects Zephyr’s userspace networking verification on zsock_sendmsg/zsock_recvmsg. The issue is a TOCTOU double-fetch: the verifier snapshots struct net_msghdr, yet later re-reads the live user memory to bound the loop, allowing a race where msg_iovlen can be inflated after the shadow buf...
EUVD-2026-57069
The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...
CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write
The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...
CVE-2026-12233 Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention
The PSA Protected Storage credential backend subsys/net/lib/tlscredentials/tlscredentialstrusted.c declared its credential-store mutex as a plain zero-filled static struct kmutex credentiallock; and never called kmutexinit on it. A statically zero-filled kmutex has an uninitialized wait queue its...
CVE-2026-12233 Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention
The PSA Protected Storage credential backend subsys/net/lib/tlscredentials/tlscredentialstrusted.c declared its credential-store mutex as a plain zero-filled static struct kmutex credentiallock; and never called kmutexinit on it. A statically zero-filled kmutex has an uninitialized wait queue its...
EUVD-2026-55967
The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...
CVE-2026-12052
The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...
EUVD-2026-55939
The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...
CVE-2026-11893
The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...
CVE-2026-11985
On the Zephyr ARM port, enabling the hardware FPU CONFIGFPU forces the "Floating point ABI" choice, which defaults to CONFIGFPHARDABI. Both FPHARDABI and FPSOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the...