Zephyrproject Zephyr any version

BT:Classic: Multiple missing buf length checks

Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

Malformed SPI in response for eswifi can corrupt kernel memory

Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values

Bluetooth: bt_conn_tx_processor unsafe handling

Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow

Disconnecting L2CAP channel right after invalid ATT request leads freeze

Truncated L2CAP K-frame causes assertion failure

ipv6: Missing ipv6 nullptr-check in handle_ra_input

BT: Assertion failure on repeated LL_FEATURE_REQ

BT: Assertion failure on repeated LL_CONNECTION_PARAM_REQ

BT: Invalid interval in CONNECT_IND leads to Division by Zero

Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read

Type Confusion in 802154 ACK Frames Handling

Infinite loop in dns_copy_qname

Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.

Bluetooth: classic: avdtp: missing buffer length check

Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error

Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation

Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)

Out-of-bound write in tcp_flags

Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)

Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer

Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query

Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)

Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation

Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)

SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

Buffer overflow in Zephyr USB

Bluetooth: integer underflow in gatt_find_info_rsp

BT: Missing length checks of net_buf in rfcomm_handle_data

Buffer Overreads in Bluetooth HCI

zephyr: out-of-bound read in utf8_trunc

Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr

Zephyr Bluetooth DLE duplicate requests vulnerability