Vulnerabilities

TI-2026-12618 CVE-2026-14986

Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction

LOW 32

The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside it…

CVSS 3.1MEDIUM 6.8 Physical No auth No interaction EPSS 0.00278 Published 2026-09-14 Fixed in 4.4.2 CWE-787

TI-2026-13513 CVE-2026-16147

it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

LOW 32

The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints.

CVSS 3.1MEDIUM 6.8 Physical No auth No interaction EPSS 0.00258 Published 2026-09-14 Fixed in 4.4.2 CWE-416

TI-2026-13339 CVE-2026-15924

Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets

LOW 27

Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00412 Published 2026-09-14 Fixed in 4.4.2 CWE-416

Vulnerabilities

Filters

Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction

it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets