Researcher credits in vendor advisories

6 November 2026 Friday

1. Zephyrproject CVE-2026-87045

   The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of every frame. handle_http_frame_header() exec

   0 CVEs and 0 credit lines.

4 November 2026 Wednesday

1. Zephyrproject CVE-2026-87044

   The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations. In mbedtls_cbc() and mbedtls_aead(), ev

   0 CVEs and 0 credit lines.

2. Zephyrproject CVE-2026-87043

   The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from rand_get() as soon as device_is_ready() fai

   0 CVEs and 0 credit lines.

3. Zephyrproject CVE-2026-87041

   The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCA

   0 CVEs and 0 credit lines.

4. Zephyrproject CVE-2026-87040

   The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum recei

   0 CVEs and 0 credit lines.

5. Zephyrproject CVE-2026-87039

   The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i2s_handlers.c copies the caller's struct i2s_config in from user memory and then, when cfg

   0 CVEs and 0 credit lines.

6. Zephyrproject CVE-2026-87038

   The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c, validated the caller-supplied struct

   0 CVEs and 0 credit lines.

7. Zephyrproject CVE-2026-85036

   The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in subsys/bluetooth/host/classic/avdtp.c ends wit

   0 CVEs and 0 credit lines.

8. Zephyrproject CVE-2026-16511

   Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kerne

   0 CVEs and 0 credit lines.

3 November 2026 Tuesday

1. Zephyrproject CVE-2026-85035

   The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_ms

   0 CVEs and 0 credit lines.

2. Zephyrproject CVE-2026-85034

   The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to bt_g

   0 CVEs and 0 credit lines.

3. Zephyrproject CVE-2026-85033

   The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connect

   0 CVEs and 0 credit lines.

4. Zephyrproject CVE-2026-85032

   The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueue runs mctp_usb_class_out_work(), which

   0 CVEs and 0 credit lines.

28 October 2026 Wednesday

1. Zephyrproject CVE-2026-82962

   ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of the packet's first frag

   0 CVEs and 0 credit lines.

2. Zephyrproject CVE-2026-82961

   The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(), z_vrfy_

   0 CVEs and 0 credit lines.

26 October 2026 Monday

1. Zephyrproject CVE-2026-82390

   The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX (defa

   0 CVEs and 0 credit lines.

2. Zephyrproject CVE-2026-82389

   In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the pee

   0 CVEs and 0 credit lines.

3. Zephyrproject CVE-2026-82388

   bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP disco

   0 CVEs and 0 credit lines.

4. Zephyrproject CVE-2026-81039

   The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it starts, in le_adv_s

   0 CVEs and 0 credit lines.

5. Zephyrproject CVE-2026-81038

   The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.

   0 CVEs and 0 credit lines.

6. Zephyrproject CVE-2026-19742

   The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 t

   0 CVEs and 0 credit lines.

23 October 2026 Friday

1. Zephyrproject CVE-2026-79982

   The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB

   0 CVEs and 0 credit lines.

2. Zephyrproject CVE-2026-79981

   The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_lock

   1 CVE and 1 credit line. Not claimed yet.

   0 of 1 credit line claimed Claim credit

3. Zephyrproject CVE-2026-79980

   The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transacti

   0 CVEs and 0 credit lines.

4. Zephyrproject CVE-2026-79979

   The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an

   0 CVEs and 0 credit lines.

5. Zephyrproject CVE-2026-79978

   The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will r

   0 CVEs and 0 credit lines.

6. Zephyrproject CVE-2026-79977

   The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when

   0 CVEs and 0 credit lines.

7. Zephyrproject CVE-2026-19741

   Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/opent

   0 CVEs and 0 credit lines.

19 October 2026 Monday

1. Zephyrproject CVE-2026-77684

   The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->

   0 CVEs and 0 credit lines.

2. Zephyrproject CVE-2026-19595

   The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with

   0 CVEs and 0 credit lines.

3. Zephyrproject CVE-2026-76788

   The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struc

   0 CVEs and 0 credit lines.

4. Zephyrproject CVE-2026-76787

   The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehu

   0 CVEs and 0 credit lines.

1 October 2026 Thursday

1. Zephyrproject zephyrproject-2026-10

   Zephyrproject Security Releases - October 2026

   0 CVEs and 0 credit lines.

29 September 2026 Tuesday

1. Zephyrproject CVE-2026-18747

   The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing

   0 CVEs and 0 credit lines.

2. Zephyrproject CVE-2026-18746

   parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of

   0 CVEs and 0 credit lines.

3. Zephyrproject CVE-2026-18417

   The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT

   0 CVEs and 0 credit lines.

1 September 2026 Tuesday

1. Zephyrproject zephyrproject-2026-09

   Zephyrproject Security Releases - September 2026

   0 CVEs and 0 credit lines.

1 July 2026 Wednesday

1. Zephyrproject zephyrproject-2026-07

   Zephyrproject Security Releases - July 2026

   0 CVEs and 0 credit lines.

1 June 2026 Monday

1. Zephyrproject zephyrproject-2026-06

   Zephyrproject Security Releases - June 2026

   0 CVEs and 0 credit lines.