CVE-2026-15923
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Zephyr SDIO subsystem has a vulnerability in sdio_io_rw_extended_helper() where func->cis.max_blk_size is decoded from the SDIO card without validation. If a card reports a maximum block size of zero, the transfer loop never terminates, causing a thread hang and permanent mutex lock, leading to denial of service for the SDIO peripheral.
Risk Assessment
A physical attack involving inserting a malicious or malfunctioning SDIO card can cause a permanent denial of service for the SDIO subsystem, including dependent features like Wi-Fi, until the device is reset.
Recommendation
Apply the fix that returns -EIO when func->cis.max_blk_size is zero, before entering the transfer loop.
Other vulnerabilities in Zephyr
See all- CVE-2026-10772Unknown
This CVE has been rejected as a duplicate. The described vulnerability involved incorrect permission checking in the Bluetooth GATT notify/indicate paths in the Zephyr stack, but was already reported as CVE-2026-2411.
- CVE-2026-10676Unknown
CVE-2026-10676 has been withdrawn as analysis determined that the reported defect is not reachable in any released version of Zephyr. In every supported release, the affected value is corrected before use.
- CVE-2026-5067Critical
Zephyr OS has a memory corruption vulnerability in the HTTP server WebSocket upgrade path. An unauthenticated remote attacker can trigger it by sending a crafted Sec-WebSocket-Key header. The bounded copy does not guarantee NUL termination, leading to out-of-bounds read/write on stack.
- CVE-2026-19673High
A vulnerability in ethernet_recv() in subsys/net/l2/ethernet/ethernet.c in the Zephyr network stack. When the ethertype is 0x8100 and VLAN is enabled on the interface, the received frame buffer is reinterpreted as an 18-byte net_eth_vlan_hdr without re-checking the length, causing an out-of-bounds read and raising hdr_len to 18. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers the issue.
- CVE-2026-19935High
A vulnerability in the Zephyr Bluetooth LE stack allows a remote, unauthenticated attacker to trigger a use-after-free in L2CAP CoC channel handling with dynamic PSMs. By sending a data frame followed by a disconnect request, the attacker can cause the system workqueue to process work referencing a freed channel, leading to memory corruption or workqueue corruption.
- CVE-2026-19740Medium
The LLCP implementation in Zephyr's Bluetooth LE Controller retains a receive node after accepting LL_PHY_UPDATE_IND, but invalid-PDU paths fail to release it before completing the procedure. An attacker can send a PDU sequence causing an assertion failure (device crash) or leaking nodes from the receive pool, leading to Bluetooth unavailability until reboot.
- CVE-2026-19669High
A vulnerability in Zephyr's syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() allocates variable-length arrays on the kernel stack sized directly by an unvalidated caller-supplied len argument. Because no bounds check occurs before allocation and copying, a user-mode thread (with CONFIG_USERSPACE) can trigger an out-of-bounds write in supervisor mode with attacker-controlled length and, on the permitted path, attacker-controlled content.
- CVE-2026-19577High
An out-of-bounds read vulnerability was found in the IPv6 subsystem of the Zephyr stack in net_route_ipv6_packet(). The issue stems from missing validation of whether a neighbor cache entry has a link-layer address before using it. An attacker on the same link can force an unresolved neighbor state and trigger an out-of-bounds read past the address array, potentially causing a system panic or data leak.
- CVE-2026-19186High
In the IEEE 802.15.4 stack in Zephyr, the function ieee802154_decipher_data_frame() does not check if the frame is long enough before computing the payload length. Subtracting the header and authentication tag length from the frame length can underflow, leading to an out-of-bounds read and write. An attacker within radio range can send a short frame, causing memory corruption and system crash.
- CVE-2026-18415Medium
The ieee802154_send() function in Zephyr's network stack copies an outgoing packet into a fixed 125-byte transmit buffer without validating its length. When 6LoWPAN fragmentation is enabled but not required, the missing size check allows an out-of-bounds write past the buffer. The flaw is reachable through NET_AF_PACKET sockets bound to an 802.15.4 interface, including from an unprivileged application thread in CONFIG_USERSPACE builds.
Original NVD description (English source)
The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func->cis.max_blk_size) as the per-iteration step. The value func->cis.max_blk_size is decoded directly from the SDIO card's CIS FUNCE tuple in sdio_decode_cis() and is not validated. When a card reports a maximum block size of zero, size is always 0, remaining never decreases, and the loop spins forever. The loop is reached from the public SDIO client API used by drivers, including sdio_read_fifo(), sdio_write_fifo(), and the incrementing register read/write helpers, each of which enters the loop while holding the per-card mutex func->card->lock. A card advertising max_blk_size == 0 therefore hangs the calling thread permanently on its first non-block-aligned transfer and never releases the mutex, denying service to the SDIO peripheral (and any subsystem such as Wi-Fi that depends on it) until the device is reset. The malicious value must come from the SDIO card itself, so the defect is exploitable where a removable SDIO/combo card slot lets an attacker insert a crafted or malfunctioning card (a physical attack vector); on boards with a soldered SDIO peripheral it is not attacker-influenceable. There is no memory-safety, confidentiality, or integrity impact — only a permanent availability loss. The fix returns -EIO when func->cis.max_blk_size is zero, before the loop is entered.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS