Vulnerabilities

TI-2026-78932 CVE-2026-19947

Missing permission check in Zephyr devmux lets user threads retarget output

LOW 23

The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set().

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00126 Published 2026-10-21 Fixed in 4.5.0 CWE-862

TI-2026-78936 CVE-2026-78119

Out-of-bounds write in Zephyr NPCX eSPI TAF receive path

LOW 27

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO.

CVSS 3.1MEDIUM 6.3 Local High privileges No interaction EPSS 0.00144 Published 2026-10-21 Fixed in 4.5.0 CWE-787

TI-2026-78935 CVE-2026-78118

Race condition in Zephyr timer wait queue handling on SMP

LOW 32

The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serialize…

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00104 Published 2026-10-21 Fixed in 4.5.0 CWE-362

Vulnerabilities

Filters

Missing permission check in Zephyr devmux lets user threads retarget output

Out-of-bounds write in Zephyr NPCX eSPI TAF receive path

Race condition in Zephyr timer wait queue handling on SMP