Zephyr
4 posts tagged with “Zephyr”
CVE-2026-11894: Zephyr RTOS Realtek BEE Bluetooth Driver Double-Free and Use-After-Free
CVE-2026-11894 is a double-free and use-after-free in the Realtek BEE Bluetooth HCI driver in Zephyr RTOS. A remote Bluetooth peer can trigger memory corruption via heavy transmit activity. Fixed in Zephyr 4.4.2.
CVE-2026-11893: Double Free in Zephyr RTOS Bluetooth HCI Driver
The Bouffalo Lab Bluetooth HCI driver in Zephyr RTOS frees a transmit buffer on every error path, violating the buffer-ownership contract. The host stack frees the same buffer again, causing a double free that corrupts the shared net_buf pool. Fixed in Zephyr 4.4.2.
CVE-2026-11811: Zephyr UpdateHub Socket Leak Exhausts Device Networking on Connection Failure
Socket file descriptor leak in Zephyr RTOS UpdateHub OTA client start_coap_client() causes resource-exhaustion denial of service when connection setup fails. Fixed in Zephyr 4.4.2.
CVE-2026-11812: Zephyr RTOS UpdateHub Race Condition Corrupts Firmware Update State
Race condition in Zephyr RTOS UpdateHub shared context causes out-of-bounds write and denial of service of the firmware update path. Fixed with mutex serialization and bounds check.