Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19575 | high | 7.8 | No | The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argumen... | 2026-11-04 |
| CVE-2026-19574 | high | 7.0 | No | The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_ini... | 2026-11-04 |
| CVE-2026-19571 | medium | 6.7 | No | The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command req... | 2026-11-04 |
| CVE-2026-19570 | high | 8.8 | No | The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement... | 2026-11-04 |
| CVE-2026-19569 | high | 8.8 | No | dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_siz... | 2026-11-04 |
| CVE-2026-18748 | low | 3.5 | No | The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte... | 2026-11-04 |
| CVE-2026-19186 | high | 8.1 | No | ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - a... | 2026-11-04 |
| CVE-2026-19185 | high | 7.8 | No | The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data b... | 2026-11-04 |
| CVE-2026-19184 | high | 8.4 | No | The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, ag... | 2026-11-04 |
| CVE-2026-18747 | medium | 6.8 | No | The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally... | 2026-11-04 |
| CVE-2026-18746 | medium | 5.9 | No | parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For... | 2026-11-04 |
| CVE-2026-18416 | medium | 5.3 | No | The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI c... | 2026-11-04 |
| CVE-2026-18415 | high | 7.1 | No | ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame... | 2026-11-04 |
| CVE-2026-18414 | high | 7.8 | No | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_se... | 2026-11-04 |
| CVE-2026-18413 | high | 7.8 | No | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_se... | 2026-11-04 |
| CVE-2026-17053 | medium | 4.4 | No | The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smb... | 2026-11-04 |
| CVE-2026-16513 | high | 7.8 | No | The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) vali... | 2026-11-04 |
| CVE-2026-17052 | high | 7.8 | No | The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated... | 2026-11-04 |
| CVE-2026-17051 | medium | 6.0 | No | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). I... | 2026-11-04 |
| CVE-2026-17050 | medium | 5.7 | No | The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap i... | 2026-11-04 |