- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 162
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 7 days
The policy commits to acknowledgement within one week
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://www.zephyrproject.org
Products and areas 12
- The 802.15.4, Thread, Wi-Fi and OpenThread integration paths, all of which parse frames off the air
- The Bluetooth stack in full: the controller, the host, GAP and GATT, SMP pairing, L2CAP, and the LE Audio profiles including BAP, CAP and the broadcast assistant
- The crypto subsystem and the TLS and DTLS integration, including PSA Crypto
- The device driver tree in full, covering UART, USB controllers, SPI, I2C, CAN, Ethernet and the sensor drivers, across every vendor's silicon in the repository
- The device firmware upgrade subsystem and its integration with the bootloader, which decides what image a device runs next
- The IP networking stack, covering IPv4 and IPv6, TCP, UDP, the socket layer, and the in-tree protocol clients such as DNS, DHCP, SNTP, MQTT, CoAP, LwM2M and HTTP
- The kernel: scheduling, threads, work queues, timers, the IPC primitives and the memory allocators
- The policy asks for any vulnerability through a draft advisory on the Zephyr repository or the project security address, and it sets out a triage state machine and a backport policy rather than a narrow asset list. The whole Zephyr tree is the declared target
- The settings, storage and filesystem subsystems, along with the flash map and non-volatile storage layers beneath them
- The shell and logging subsystems, and anything else that parses text a remote party supplied
- USB device and host stacks, including every class driver that reads descriptors from the other end of the cable
- User mode and the system call boundary, plus the memory domain and MPU configuration meant to keep a user thread out of kernel memory
Out of scope (6)
- Application code written against Zephyr that misuses an API in a way the documentation warns against
- Board and configuration choices an integrator made, including building without user mode or leaving the shell enabled on a production device
- MCUboot itself, a separate project with its own repository and its own policy
- Out-of-tree drivers, modules and board ports
- Physical attacks on a device an attacker already holds, including debug-port readout of flash
- Silicon vendor SDK forks such as Nordic's nRF Connect SDK, where a defect that exists only in the vendor's own additions belongs to that vendor
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
The preferred channel is a draft security advisory on the Zephyr repository's security advisories page; reports may also go by email
-
Name the board, the SoC and the subsystem.
-
Backporting to supported LTS branches is part of the documented process, so state which branches you reproduced on where you can
-
Say whether the finding needs user mode enabled
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-18417 | The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTER(-status) in zsock_accepted_cb(), zsock_received_cb(), zsock_connected_cb() and zsock_close_ctx() in subsys/net/lib/sockets/sockets_inet.c), reading it back with POINTER_TO_INT(). That same field is owned by the network stack for | Medium 6.5 | 29 Sep 2026 |
| CVE-2026-18746 | parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called init_block_ctx() and then immediately stored the peer-selected block size with block_ctx->ctx.block_size = block_size before inspecting the return code. init_block_ctx() sets the caller's pointer to NULL and returns -EN | Medium 5.9 | 29 Sep 2026 |
| CVE-2026-18747 | The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rx_ctxt->nb->len -= 2U; in mcumgr_serial_process_frag() (subsys/mgmt/mcumgr/transport/src/serial_util.c). mcumgr_serial_extract_len() accepted any declared length, including 0 and 1, and a packet declaring length 0 passes the check | Medium 6.8 | 29 Sep 2026 |
| CVE-2026-18416 | The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing it against the option length len. When a registered path segment is longer than the supplied URI | Low 3.7 | 28 Sep 2026 |
| CVE-2026-16513 | The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop iteration it executed *handle = sqe, storing the kernel address of the newly acquired submission-queue entry through a pointer taken verbatim from user m | High 7.8 | 28 Sep 2026 |
| CVE-2026-18413 | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the buffer turns out to be not large enough". The NXP MCUX LPADC driver did not honour that contract. mcu | High 7.8 | 28 Sep 2026 |
| CVE-2026-18414 | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the buffer turns out to be not large enough". The ADI MAX32 driver did not honour that contract. start_re | High 7.8 | 28 Sep 2026 |
| CVE-2026-18415 | ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized IEEE802154_MTU). In builds with CONFIG_NET_L2_IEEE802154_FRAGMENT enabled (the default whenever CONFIG_NET_6LO is set), the branch taken when 6LoWPAN fragmentation is not required performed an unchecked net_buf_add_mem(frame_buf, pkt_buf->data | Medium 6.3 | 28 Sep 2026 |
| CVE-2026-13479 | The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command the handler then reads a 4-byte time correction via sys_get_le32() plus a 1-byte token without checking that 5 bytes rema | Low 3.1 | 26 Aug 2026 |
| CVE-2026-13480 | The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rx_pos < len; after consuming the one-byte command id the handler cast rx_buf + rx_pos to a 10-byte struct frag_transport_setup_req, and | Low 3.1 | 26 Aug 2026 |
| CVE-2026-13481 | The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME case casts mgmt_tlv->data to a 10-byte struct ptp_timestamp and reads it (then byte-swaps and writes it back) without first checking that the TLV data field is at least sizeof(struct ptp_timestamp). Every sibling management id in the same sw | Medium 5.4 | 26 Aug 2026 |
| CVE-2026-11368 | The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent), | High 7.1 | 4 Aug 2026 |
| CVE-2026-10849 | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the full response has arrived, the code writes response_data[downloaded_size] = '\0' — and whenever | High 8.2 | 3 Aug 2026 |
| CVE-2026-10848 | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at | High 7.0 | 2 Aug 2026 |
| CVE-2026-10774 | Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_keys_destroy() guarded the matching psa_destroy_key() with CONFIG_BT_MESH_V1d1. That Kconfig symbol was removed when explic | Low 2.4 | 2 Aug 2026 |
| CVE-2026-10773 | The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds check. The guard used msg_type <= sizeof(name) instead of msg_type <= ARRAY_SIZE(name); sizeof returns the byte size of the pointer array (32 on 32-bit, 64 on 64-bit targets) rather than the element count of 8, so message-type values from 9 | Medium 5.4 | 1 Aug 2026 |
| CVE-2026-2411 | Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and | Medium 6.5 | 1 Aug 2026 |
| CVE-2026-10686 | Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_route_packet() (subsys/net/ip) were affected: the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()). Each set the packet forwarding flag and called net_send_data() with the hop limit untouched and no expiry chec | Medium 5.8 | 31 Jul 2026 |
| CVE-2026-10685 | The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may b | High 7.6 | 31 Jul 2026 |
| CVE-2026-10683 | In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START, was never added to the enabled inter | Low 2.4 | 27 Jul 2026 |
| CVE-2026-10682 | The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative value for src_id (e.g. -1) trivially satisfied this check and was forwarded into z_impl_log_filter_set, where it propagated to filter_set() and ultimately to get_dyna | Medium 6.6 | 27 Jul 2026 |
| CVE-2026-10681 | In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index from the global _thread_idx_map[] bitmap without holding lists_lock. On SMP systems, two user-mode threads invoking the k_object_alloc(K_OBJ_THREAD) syscall concurrently can both observe the same low free bit, perform the same non-atomic RMW to clear it, and r | Medium 6.5 | 25 Jul 2026 |
| CVE-2026-7007 | The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divi | Medium 4.6 | 24 Jul 2026 |
| CVE-2026-10675 | In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_ti | Medium 4.3 | 21 Jul 2026 |
| CVE-2026-10677 | The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then validates each event's object handle. Before this fix, validation used K_OOPS(K_SYSCALL_OBJ(...)) inline inside the loop, which kills the calling thread without freeing events_copy. A user thread can pass num_events >= 1 with a forge | Medium 6.5 | 21 Jul 2026 |
| CVE-2026-10678 | The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive bu | High 8.1 | 21 Jul 2026 |
| CVE-2026-10679 | The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency. spi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access | Low 3.3 | 21 Jul 2026 |
| CVE-2026-10680 | The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length from the L2CAP signaling header). Because multiple signaling commands can be packed into one PDU, buf->len may exceed a co | High 7.6 | 21 Jul 2026 |
| CVE-2026-10674 | The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the start of mcux_lpuart_configure(), which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards (in mcux_lpuart_configure_basic), and unsupported parity/data-bit/stop-bit/flow-control values return -ENOTSUP before | Medium 5.5 | 21 Jul 2026 |
| CVE-2026-10673 | The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes). In eth_adin2111_oa_data_read(), each valid chunk was memcpy'd into ctx->buf[ctx->scur] and th | High 8.3 | 15 Jul 2026 |
| CVE-2026-10672 | subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM | High 8.2 | 14 Jul 2026 |
| CVE-2026-10669 | On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return value to 0 (access permitted) and only set a denial result inside its per-MPU-region probe loop. When the rounded extent of t | High 7.8 | 14 Jul 2026 |
| CVE-2026-10670 | The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_find() on the caller-supplied thread pointer and then dereferences the returned struct k_object without checking it for NULL. k_object_find() returns NULL whenever the supplied pointer is not a registered (static or dynamic) kernel object. The pre-fix g | Medium 5.5 | 14 Jul 2026 |
| CVE-2026-10671 | In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVER_INIT() (which rejects an already-initialized object). As a result, on CONFIG_USERSPACE builds an unprivileged user thread that has been granted access to a k_pipe object can invo | High 7.1 | 14 Jul 2026 |
| CVE-2026-10666 | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte stack buffer (char ipaddr[NET_IPV4_ADDR_LEN + 1]) using a length of str_len - end - 1, where str_len is the full, unbounded input length and end is only the (<=15-byte) offset of the ':' delimiter. Because the destination size is never consult | High 8.1 | 12 Jul 2026 |
| CVE-2026-10667 | Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated kernel objects. Iteration over this list in k_object_wordlist_foreach() was performed under lists_lock using the SAFE iterator (which caches the next node), but list removal and freeing of nodes was performed under different, disjoin | High 7.8 | 12 Jul 2026 |
| CVE-2026-10668 | The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len in numaker_hsusbd_ep_trigger). Because the HSUSBD hardware cannot disarm a control Data IN already armed for a previous transfer, a USB host that cancels an in-flight control transfer (timeout) and then issues a new SETUP packet can drive the | Low 2.4 | 12 Jul 2026 |
| CVE-2026-10664 | The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow entries from an nrf_wifi_umac_event_power_save_info event into the fixed-size twt_flows[WIFI_MAX_TWT_FLOWS] (8-element) array of a caller-supplied struct wifi_ps_config, looping over event-provided num_twt_flows without validating i | Medium 5.0 | 12 Jul 2026 |
| CVE-2026-10665 | In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The call net_buf_linearize(buf->data, data_len, pkt->buffer, ..., data_len) passed the attacker-derived data_len as both the destination capacity and the copy length, defeating | High 7.4 | 12 Jul 2026 |
| CVE-2026-10663 | In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() (subsys/usb/host/usbh_core.c) decides what to tear down solely from ctx->root, checking only that it is non-NULL. Because UHC controller drivers (e | Medium 6.1 | 12 Jul 2026 |
| CVE-2026-10659 | The Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) implemented the dhara_nand_ callbacks so that, on a flash error, the error code was written unconditionally through the caller-supplied dhara_error_t err pointer (e.g. *err = DHARA_E_ECC in dhara_nand_read, and similar in dhara_nand_erase/prog/copy). The upstream Dhara library calls these callbacks with err == NULL along its | Medium 4.7 | 7 Jul 2026 |
| CVE-2026-10656 | The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c, compatible adi_max32_usbhs) dereferenced an endpoint buffer in its OUT and IN transfer-completion handlers without checking it for NULL. udc_event_xfer_out_done() called net_buf_add(buf, ep_request->actlen) immediately after buf = udc_buf_get(ep_cfg), where udc_buf_get() returns NULL when the endpoint FIFO is empty. A transfer | Medium 4.6 | 5 Jul 2026 |
| CVE-2026-10657 | Zephyr's DNS resolver detects mDNS (.local) queries in dns_resolve_name_internal() (subsys/net/lib/dns/resolve.c) with memcmp(strrchr(query, '.'), ".local", 7), which always reads a fixed 7 bytes from the suffix pointer. When the resolved hostname's final label is shorter than 7 bytes (e.g. names ending in .org, .com, .net, .io, or a trailing dot), the comparison reads 1-2 bytes past the string's | Low 3.7 | 5 Jul 2026 |
| CVE-2026-9263 | The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment (sc=0) always carries a 3-byte time_offset, so its segment-header len must be at least PDU_ISO_SEG_TIMEOFFSET_SIZE (3). isoal_check_seg_header() accepted start segments with len < 3 as | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-10652 | Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in dns_unpack_answer(), which validated only the fixed RR header (type, class, TTL, rdlength) and accepted any attacker-declared rdlength, including one extending past the end of the received datagram. The TXT and SRV consumers in dns_validate_record() (resolve.c) then read up to rdlength bytes (clamped only to a | Medium 4.8 | 30 Jun 2026 |
| CVE-2026-10653 | The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the start of each variable/heap data allocation -- with plain non-atomic C operators (buf->ref++, if (--buf->ref > 0), if (--(*ref_count))). The API is documented as self-synchronizing: callers may share one buffer across threads (e.g. via k_fifo) a | Medium 6.4 | 30 Jun 2026 |
| CVE-2026-10654 | A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the connected peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc() invokes rfcomm_se | Low 3.1 | 30 Jun 2026 |
| CVE-2026-10655 | The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP socket file descriptor directly from the calling thread immediately after detaching it from the network socket service, without synchronizing with the socket-service poll thread. The socket service thread polls each socket via zvfs_poll, which (in zsock_poll_prepare_ctx) registers a k_poll_event po | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-7656 | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was ((length/hop/source/target checks) && (icmp_hdr->code != 0)). Because every legitimate ND message carries ICMPv6 code 0, an at | High 8.1 | 29 Jun 2026 |
| CVE-2026-8023 | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabled) that serves files from a configured root directory. Before this fix, both the HTTP/1 and HTTP/2 front-ends placed the raw, attacker-controlled request path into client->url_buffer (assembled in on_url() for HTTP/1 and copied verbatim fro | High 7.5 | 29 Jun 2026 |
| CVE-2026-10648 | mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for NULL. smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) against the shared MCUmgr packet pool (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT, default 4), which returns NULL when the pool is exhausted. In default builds the __ASSERT_NO_MSG in net_buf_ | Medium 6.2 | 29 Jun 2026 |
| CVE-2026-10647 | The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send(). When the enqueue fails, the function still calls k_sem_take(&data->sync_sem, K_FOREVER), blocking on a completion semaphore that is only ever signaled from the bulk-IN transfer-completion callback. Because nothing was enqueued, t | Medium 5.3 | 29 Jun 2026 |
| CVE-2026-10644 | The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c), used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchronous (DMA) receive path. When uart_rx_enable() is invoked with a one-byte receive buffer (len == 1) and CONFIG_UART_MCHP_ASYNC is enabled, the RX-complete ISR starts a single-beat DMA transfer while a received byte is already pending in the S | Medium 4.2 | 28 Jun 2026 |
| CVE-2026-10646 | Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo_state ai_state) as the user_data of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set slightly longer than the resolver's own per-query timeout. When that semaphore wait nonetheless ti | High 7.4 | 28 Jun 2026 |
| CVE-2026-10593 | The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream->qos pointer with only a stream != NULL guard. stream->qos is NULL for any stream | Medium 6.5 | 28 Jun 2026 |
| CVE-2026-10643 | Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of an aligned cmsg header plus the payload. Because the check omitted the cmsg header size, a control buffer whose length fa | High 8.7 | 28 Jun 2026 |
| CVE-2026-13351 | Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. Repeating the malicious packet exhausts all RX buffer slots, | High 7.5 | 25 Jun 2026 |
| CVE-2026-10642 | The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the interrupt-driven application callback while the TX interrupt mask bit (PL011_IMSC_TXIM) is set, to work around the controller's level-transition TX-interrupt behavior. When CTS hardware flow control is enabled (devicetree hw-flow-control or runtime UAR | Medium 6.5 | 24 Jun 2026 |
| CVE-2026-10651 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the data-element descriptor (type), via net_buf_simple_pull_u8(). Because net_buf_simple_pull_u8() dereferences buf->data[0] before its only bounds guard (an __ASSERT_NO_MSG that compi | High 7.1 | 23 Jun 2026 |
| CVE-2026-10658 | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf->len. The upstream hci_iso() handler enforces buf->len == the controller-declared ISO Data_Load length, so a malicious or buggy controller / adjacent BLE peer | High 7.1 | 23 Jun 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 75 Last 12 months 162 Lifetime Memory safety 45 % Denial of service 25 % Info disclosure 20 % Parsing/validation 10 % Latest advisories Loading the feed Overview Zephyr is the RTOS that Nordic Semiconductor's nRF Connect SDK is built from, which puts it on a large share of Bluetooth silicon, and NXP, Intel, ST, Renesas, Analog Devices and Espressif all ship ports of it. It runs Bluetooth LE Audio and hearing-aid stacks, wearables, Matter devices and industrial sensors. CVE-2026-10660 is the reference point: a shared reassembly buffer in the Bluetooth broadcast assistant leaked memory across connections, reachable by anyone in radio range. The project published seventy-five advisories in the last year and compensated every one of them with a credit line, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy asks for any vulnerability through a draft advisory on the Zephyr repository or the project security address, and it sets out a triage state machine and a backport policy rather than a narrow asset list. The whole Zephyr tree is the declared target The kernel: scheduling, threads, work queues, timers, the IPC primitives and the memory allocators User mode and the system call boundary, plus the memory domain and MPU configuration meant to keep a user thread out of kernel memory The Bluetooth stack in full: the controller, the host, GAP and GATT, SMP pairing, L2CAP, and the LE Audio profiles including BAP, CAP and the broadcast assistant The IP networking stack, covering IPv4 and IPv6, TCP, UDP, the socket layer, and the in-tree protocol clients such as DNS, DHCP, SNTP, MQTT, CoAP, LwM2M and HTTP The 802.15.4, Thread, Wi-Fi and OpenThread integration paths, all of which parse frames off the air USB device and host stacks, including every class driver that reads descriptors from the other end of the cable The device driver tree in full, covering UART, USB controllers, SPI, I2C, CAN, Ethernet and the sensor drivers, across every vendor's silicon in the repository The settings, storage and filesystem subsystems, along with the flash map and non-volatile storage layers beneath them The device firmware upgrade subsystem and its integration with the bootloader, which decides what image a device runs next The shell and logging subsystems, and anything else that parses text a remote party supplied The crypto subsystem and the TLS and DTLS integration, including PSA Crypto Out of scope Silicon vendor SDK forks such as Nordic's nRF Connect SDK, where a defect that exists only in the vendor's own additions belongs to that vendor MCUboot itself, a separate project with its own repository and its own policy Application code written against Zephyr that misuses an API in a way the documentation warns against Board and configuration choices an integrator made, including building without user mode or leaving the shell enabled on a production device Out-of-tree drivers, modules and board ports Physical attacks on a device an attacker already holds, including debug-port readout of flash Most-valued findings Anything in the Bluetooth reception path, the densest area of the current record. CVE-2026-10660 shared a reassembly buffer across connections in the BAP broadcast assistant and disclosed one connection's memory to another, and the attacker needs only to be in range Memory corruption in the networking stack, particularly use-after-free in asynchronous clients, the class CVE-2026-10655 landed in with a race in the SNTP async client Vendor driver defects, which the record shows arriving as a steady stream: CVE-2026-10674 was a denial of service in the NXP LPUART driver and CVE-2026-10656 a null dereference in the MAX32 USB device controller User mode escapes and system call boundary flaws, since memory domains and the syscall layer are the only privilege separation Zephyr offers Parsing bugs in the in-tree protocol clients, especially CoAP, LwM2M and MQTT, all of which read attacker-controlled bytes from a remote endpoint by design Anything in the firmware upgrade path or its bootloader integration that lets an attacker-chosen image be accepted Cryptographic and TLS integration flaws, which constrained devices depend on entirely for confidentiality on the wire Defects in a shared subsystem rather than one board, since the fanout through the Nordic, NXP and ST SDKs multiplies the field impact enormously Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. The preferred channel is a draft security advisory on the Zephyr repository's security advisories page; reports may also go by email to [email protected] The policy commits to acknowledgement within one week and runs a documented state machine from New through Triage, Assigned, Review and Accepted to Public, so you can tell where a report actually is A Trusted Zephyr Users tier is pre-notified ahead of public disclosure, so expect an embargo with a defined audience rather than a fixed day count Name the board, the SoC and the subsystem. Zephyr covers hundreds of boards and a large share of advisories are specific to one vendor's driver Backporting to supported LTS branches is part of the documented process, so state which branches you reproduced on where you can Say whether the finding needs user mode enabled, since memory domains and the system call boundary only exist in that configuration The word bounty appears nowhere on the reporting page, the security overview or the project site, and no Zephyr programme exists on any bounty platform, so there is no payment to negotiate upstream Disclosure Coordinated through a draft GitHub Security Advisory or the project security address, with a one-week acknowledgement commitment, a documented triage state machine, an embargo and backport policy, and a Trusted Zephyr Users tier notified ahead of the public. Throughput is the highest in this whole category: seventy-five advisories in twelve months against one hundred and sixty-two ever published. A fix then has to travel through Nordic, NXP or ST into an SDK and out to a shipped device, so field exposure long outlasts the embargo. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability