A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device

An malicious BLE device can crash BLE victim device by sending malformed gatt packet

In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee

Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack

A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete

Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr

BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known

Zephyr Bluetooth unchecked packet data results in denial of service

In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resulting in a denial of service

In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places

SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt

TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers

Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption

Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length

Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption

Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)

Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init

Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.

Zephyr RTIO syscall verifier validates output parameters for read instead of write access

Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length

Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties

Use-after-free / double-free of the root USB device in the experimental USB host stack

net: Stack Overflow with Ping (to own IP Address) via Shell

stm32: usb: Infinite while loop in Interrupt Handler

Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length

NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum

Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver

Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted

Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets

NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi

Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention

Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)

Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it

Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race

Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service

Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

Double free of the USB host configuration descriptor when device enumeration fails

Incorrect Error Handling in Bluetooth HCI core

Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS

NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction

Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count

Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled

User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier

NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion

Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image

Remote Denial of Service in LwM2M do_write_op_tlv