Vulnerabilities

TI-2026-09169 CVE-2026-10667

SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads

HIGH 69

Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated kernel objects.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00149 Published 2026-07-12 Fixed in 4.6.0 CWE-416

TI-2026-09168 CVE-2026-10666

Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

HIGH 76

parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte stack buffer (char ipaddr[NET_IPV4_ADDR_LEN + 1]) using a lengt…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00654 Published 2026-07-12 Fixed in 4.6.0 CWE-121

TI-2026-09166 CVE-2026-10664

Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)

MEDIUM 56

The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow entries from an nrf_wifi_umac_event_power_save_info…

CVSS 3.1MEDIUM 5.0 Adjacent network No auth No interaction EPSS 0.00223 Published 2026-07-12 Fixed in 4.6.0 CWE-787

Vulnerabilities

Filters

SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads

Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)