Zephyr vulnerabilities and CVEs

Known vulnerabilities affecting Zephyr, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

7 vulnerabilities tracked.

8.8 The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI… CVE-2026-79982 23 Oct 2026
8.2 The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. CVE-2026-79977 23 Oct 2026
7.8 The arm64 MMU backend invalidates a single virtual address from the TLB with invalidatetlbpage() in arch/arm64/core/mmu.c, which issued… CVE-2026-79979 23 Oct 2026
7.5 Zephyr's OpenThread integration defined CONFIGOPENTHREADJOINERPSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously… CVE-2026-19741 23 Oct 2026
6.5 The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised… CVE-2026-79981 23 Oct 2026
5.6 The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather… CVE-2026-79980 23 Oct 2026
3.6 The RTIO streaming completion callback adxl345processfifosamplescb() in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of… CVE-2026-79978 23 Oct 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Zephyr is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Zephyr vulnerabilities and CVEs

What this covers

Other products tracked here