Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: zephyrproject zephyr 4.3.2, 4.5.0 Clear all filters
TI-2026-84938 CVE-2026-87041

Inverted buffer checks in Zephyr RTIO expose kernel memory

Priority LOW 33

The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00114 Published 2026-11-04 Fixed in 4.3.2, 4.5.0 CWE-125
TI-2026-84937 CVE-2026-87040

Out-of-bounds read and write in Zephyr Bluetooth LE Controller

Priority LOW 36

The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum receive length that was used to program the radio.

CVSS 3.1HIGH 8.3 Adjacent network No auth No interaction EPSS 0.00287 Published 2026-11-04 Fixed in 4.3.2, 4.5.0 CWE-120
TI-2026-84935 CVE-2026-87038

TOCTOU race in Zephyr i3c_transfer() lets user code run in kernel

Priority LOW 29

The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c, validated the caller-supplied struct i3c_device_desc in place instead of snapshotting it.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00087 Published 2026-11-04 Fixed in 4.3.2, 4.5.0 CWE-367
TI-2026-84933 CVE-2026-16511

Zephyr RTIO syscalls let user threads write kernel memory

Priority LOW 37

Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00173 Published 2026-11-04 Fixed in 4.3.2, 4.5.0 CWE-787
TI-2026-84934 CVE-2026-85036

Session reuse corrupts Zephyr system work queue over Bluetooth Classic

Priority LOW 25

The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in subsys/bluetooth/host/classic/avdtp.c ends with k_work_submit(&session->_release_work), placing the embedd…

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.00211 Published 2026-11-04 Fixed in 4.3.2, 4.5.0 CWE-666