Type Confusion in 802154 ACK Frames Handling

A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service

Heap buffer overflow on WireGuard receive path via unbounded incoming packet length

Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)

Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation

Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses

NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header

Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address

Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames

User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)

Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation

Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)

Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)

Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query

Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation

SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot