Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path

Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)

Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer

Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)

Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly

AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization

Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service

Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder

Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion

Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)

Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure

Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callback

net: TLS 1.2 connections allowed on TLS 1.3 sockets

net: ip/tcp: Null pointer dereference can be triggered by a race condition

In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero

Improper Handling of Insufficient Permissions or Privileges in zephyr

Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path

Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response

Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing

Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)

Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference

Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack

Use-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack

ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack

NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume

Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size

PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service

NULL pointer dereference in USB DFU device_next download handler (handle_download)

DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)

Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver

NULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlers

Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control

In preloader, there is a possible read of device unique identifiers due to a logic error

There is no check to see if slot 0 is being uploaded from the device to the host

SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity

Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved

Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler

6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode

Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air

Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver