Zephyrproject Zephyr

net: eswifi socket send payload length not bounded

L2CAP: Stack based buffer overflow in le_ecred_conn_req()

Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validation

Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace

can: Local Denial of Service via SocketCAN Send

SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads

net: shell: Improper input validation

BT: HCI: adv_ext_report Improper discarding in adv_ext_report

BT: Classic: SDP OOB access in get_att_search_list

BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero

BT:Classic: Multiple missing buf length checks

Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

Malformed SPI in response for eswifi can corrupt kernel memory

Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values

Bluetooth: bt_conn_tx_processor unsafe handling

Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow

Disconnecting L2CAP channel right after invalid ATT request leads freeze

Truncated L2CAP K-frame causes assertion failure

Zephyr JSON decoder incorrectly decodes array of array

ipv6: Missing ipv6 nullptr-check in handle_ra_input

BT: Assertion failure on repeated LL_FEATURE_REQ

BT: Assertion failure on repeated LL_CONNECTION_PARAM_REQ

BT: Invalid interval in CONNECT_IND leads to Division by Zero

Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read

Type Confusion in 802154 ACK Frames Handling

Infinite loop in dns_copy_qname

Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.

Bluetooth: classic: avdtp: missing buffer length check

Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error

Heap buffer overflow on WireGuard receive path via unbounded incoming packet length

Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation

Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)

Out-of-bound write in tcp_flags

Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)

Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer

Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query

Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)