Zephyr memory and buffer flaws in USB, Bluetooth and CAN code
Small-device operating system can be broken into or frozen under some conditions.
Summary
Several flaws in Zephyr's USB, Bluetooth and CAN code allow memory corruption, lost function, or misuse by a connected USB host, a paired Bluetooth device, or user-mode code. Builds that enable the affected options are exposed.
Affected when
- CONFIG_MCTP_USB enabled
- CONFIG_SMP or preemptible CONFIG_SYSTEM_WORKQUEUE_PRIORITY set
- Bluetooth Classic AVRCP Target in use
- ATT MTU above 515 octets (CONFIG_BT_L2CAP_TX_MTU, CONFIG_BT_BUF_ACL_RX_SIZE)
- CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y build, with a user-mode thread granted CAN device access
What to do
The affected versions end before 4.5.0, and the CAN item before 4.3.2. Check that the Zephyr you run is newer than these versions and read the vendor's advisory.
Products and platforms
CVE IDs
- CVE-2026-85032 (opens in a new tab)
- CVE-2026-85033 (opens in a new tab)
- CVE-2026-85034 (opens in a new tab)
- CVE-2026-85035 (opens in a new tab)
- CVE-2026-85036 (opens in a new tab)
- CVE-2026-16511 (opens in a new tab)
- CVE-2026-87038 (opens in a new tab)
- CVE-2026-87040 (opens in a new tab)
- CVE-2026-87041 (opens in a new tab)
- CVE-2026-87039 (opens in a new tab)
- CVE-2026-87043 (opens in a new tab)
- CVE-2026-87044 (opens in a new tab)
Sources
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen