Zephyr 4.4.2

This is a bugfix release for Zephyr 4.4.1.

Security Vulnerability Related

• CVE-2026-7007 Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image
• CVE-2026-8023 Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read
• CVE-2026-9728 Under embargo until 2026-08-23
• CVE-2026-9771 Under embargo until 2026-08-16
• CVE-2026-10593 Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling
• CVE-2026-10635 Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init
• CVE-2026-10641 Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)
• CVE-2026-10642 Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control
• CVE-2026-10643 Out-of-bounds heap write in Zephyr recvmsg() ancillary-data path (insert_pktinfo undersizes the control-buffer capacity check)
• CVE-2026-10644 Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer
• CVE-2026-10646 Use-after-return in zsock_getaddrinfo() when a timed-out DNS query is retried without cancellation
• CVE-2026-10647 Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure
• CVE-2026-10651 Out-of-bounds read in Bluetooth Classic SDP attribute parsing (bt_sdp_parse_attribute)
• CVE-2026-10653 Non-atomic net_buf reference counts cause double-free / free-list corruption under concurrent unref
• CVE-2026-10654 RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic
• CVE-2026-10655 Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it
• CVE-2026-10657 Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)
• CVE-2026-10658 Out-of-bounds access in Bluetooth ISO receive (bt_iso_recv) due to missing SDU-header length validation
• CVE-2026-10659 NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume
• CVE-2026-10660 Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption
• CVE-2026-10663 Use-after-free / double-free of the root USB device in the experimental USB host stack
• CVE-2026-10665 Heap buffer overflow on WireGuard receive path via unbounded incoming packet length
• CVE-2026-10667 SMP use-after-free in Zephyr CONFIG_USERSPACE dynamic kernel-object tracking, reachable from unprivileged user threads
• CVE-2026-10668 Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver
• CVE-2026-10670 User-triggerable kernel NULL-pointer dereference (DoS) in k_thread_name_copy() syscall verifier
• CVE-2026-10671 User thread can re-initialize an in-use k_pipe, corrupting kernel wait queues (CONFIG_USERSPACE)
• CVE-2026-10674 DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled
• CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)
• CVE-2026-10677 Kernel heap memory leak in z_vrfy_k_poll() lets an unprivileged user thread exhaust the kernel resource pool
• CVE-2026-10678 NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller
• CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)
• CVE-2026-10680 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via uint16_t length underflow
• CVE-2026-10681 SMP race in thread_idx_alloc() lets concurrent k_object_alloc(K_OBJ_THREAD) callers share a kernel-object permission slot
• CVE-2026-10682 Out-of-bounds write in Zephyr log_filter_set syscall verifier reachable from userspace
• CVE-2026-10683 DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)
• CVE-2026-10685 Under embargo until 2026-07-31
• CVE-2026-10686 Under embargo until 2026-07-31
• CVE-2026-10772 Under embargo until 2026-08-01
• CVE-2026-10773 Under embargo until 2026-08-01
• CVE-2026-10774 Under embargo until 2026-08-02
• CVE-2026-10848 Under embargo until 2026-08-02
• CVE-2026-10849 Under embargo until 2026-08-03
• CVE-2026-11368 Under embargo until 2026-08-04
• CVE-2026-11742 Under embargo until 2026-08-07
• CVE-2026-11743 Under embargo until 2026-08-07
• CVE-2026-11809 Under embargo until 2026-08-08
• CVE-2026-11810 Under embargo until 2026-08-08
• CVE-2026-11811 Under embargo until 2026-08-08
• CVE-2026-11812 Under embargo until 2026-08-08
• CVE-2026-11893 Under embargo until 2026-08-09
• CVE-2026-11894 Under embargo until 2026-08-09
• CVE-2026-11985 Under embargo until 2026-08-09
• CVE-2026-12051 Under embargo until 2026-08-10
• CVE-2026-12052 Under embargo until 2026-08-10
• CVE-2026-12233 Under embargo until 2026-08-11
• CVE-2026-12234 Under embargo until 2026-08-11
• CVE-2026-12236 Under embargo until 2026-08-13
• CVE-2026-12364 Under embargo until 2026-08-14
• CVE-2026-12519 Under embargo until 2026-08-16
• CVE-2026-12520 Under embargo until 2026-08-16
• CVE-2026-12521 Under embargo until 2026-08-16
• CVE-2026-12522 Under embargo until 2026-08-16
• CVE-2026-12629 Under embargo until 2026-08-16
• CVE-2026-12630 Under embargo until 2026-08-16
• CVE-2026-12631 Under embargo until 2026-08-16
• CVE-2026-12632 Under embargo until 2026-08-16
• CVE-2026-12633 Under embargo until 2026-08-16
• CVE-2026-12999 Under embargo until 2026-08-22
• CVE-2026-13213 Under embargo until 2026-08-23
• CVE-2026-13214 Under embargo until 2026-08-23
• CVE-2026-13215 Under embargo until 2026-08-23
• CVE-2026-13217 Under embargo until 2026-08-23
• CVE-2026-13478 Under embargo until 2026-08-25
• CVE-2026-13479 Under embargo until 2026-08-26
• CVE-2026-13480 Under embargo until 2026-08-26
• CVE-2026-13481 Under embargo until 2026-08-26
• CVE-2026-13734 Under embargo until 2026-08-28
• CVE-2026-13735 Under embargo until 2026-08-28
• CVE-2026-14366 Under embargo until 2026-08-30
• CVE-2026-14367 Under embargo until 2026-08-30
• CVE-2026-14368 Under embargo until 2026-08-30
• CVE-2026-14696 Under embargo until 2026-08-31
• CVE-2026-14697 Under embargo until 2026-08-31
• CVE-2026-15460 Under embargo until 2026-09-07
• CVE-2026-15461 Under embargo until 2026-09-08
• CVE-2026-15890 Under embargo until 2026-09-11
• CVE-2026-15891 Under embargo until 2026-09-11
• CVE-2026-15892 Under embargo until 2026-09-12
• CVE-2026-15893 Under embargo until 2026-09-13
• CVE-2026-15923 Under embargo until 2026-09-13
• CVE-2026-15924 Under embargo until 2026-09-13

More detailed information can be found in:
https://docs.zephyrproject.org/latest/security/vulnerabilities.html

Issues fixed

The following issues are addressed by this release:

• #103831 - Add mcxc242 lpuart dma support (async api)
• #104900 - Bluetooth LE host qualification for 4.4 release
• #104922 - drivers: nuvoton: hs usbd: control cmds stuck naking
• #106334 - Thread-safety race condition in net_buf_unref
• #107374 - ESP32 S3 doesn't boot if CONFIG_ESP32_WIFI_NET_ALLOC_SPIRAM is combined with CONFIG_SPI
• #107633 - USB-Next: CDC-ACM: Incomplete transmission on MCUmgr
• #108120 - STM32WBAx : Flash process request is not handled
• #108637 - tests/drivers/bbram/generic/ fails at random due to drivers/bbram/bbram_microchip_mcp7940n_emul.c
• #108793 - kernel: init: main thread not tagged K_FP_REGS when CONFIG_FPU && CONFIG_FPU_SHARING
• #109128 - fs: backend file resource leak when fs_open with FS_O_TRUNC fails during truncate
• #109383 - stm32wbax: bluetooth: issue when extended Advertising Data Packet length exceeds 250 bytes
• #109403 - net: icmpv6: missing source address guard in net_icmpv6_send_error (RFC 4443 2.4(e.6))
• #109460 - entropy: psa: ENTROPY_PSA_CRYPTO_RNG deprecated without migration path
• #109602 - espressif: esp32c5/esp32s3: fix PSRAM + Wi-Fi heap mapping and linker segment sizing bugs
• #109641 - west spdx fails on Windows if project is on a different drive
• #109907 - tests: dma: chan_blen_transfer: test case is not synchronized with transfer callback
• #110018 - drivers: gpio: esp32: GPIO deep sleep wakeup requires CONFIG_PM
• #110077 - k_pipe_read in ISR causing fault
• #110303 - Bluetooth: Mesh: PrivateBeaconKey PSA key leak after subnet deletion
• #110643 - drivers: stepper: adi_tmc: tmc51xx configure_ramp appears to use child device for clock lookup
• #110645 - net: sockets: recvmsg() ancillary-data capacity check undercounts cmsg size
• #110651 - usb: device_next: cdc_ncm: TX thread deadlocks when usbd_ep_enqueue() fails
• #110654 - drivers: can: nxp: flexcan: bus errors when transmitting leads to log flooding
• #110749 - drivers: uart: sercom g1: async RX of a 1-byte buffer writes one byte past the buffer
• #110757 - xtensa: ptables: deinitialized memory domain is left on the global domain list
• #110762 - bluetooth: classic: hfp_hf: cind_handle_values() writes past ind_table on a long +CIND list
• #110766 - drivers: serial: pl011: TX enable spins forever when CTS flow control blocks transmission
• #110771 - net: sockets: getaddrinfo() retry after a DNS timeout leaves the previous query in flight and touches stale stack state
• #110775 - Bluetooth: BAP: unicast client dereferences NULL stream->qos when a QoS Configured notification arrives before the stream is added to a group
• #110849 - bluetooth: classic: sdp: bt_sdp_parse_attribute() reads one byte past the buffer end
• #110854 - bluetooth: classic: rfcomm: session stuck and L2CAP channel leaked when both sides disconnect simultaneously
• #110857 - net: sntp: close-while-polling use-after-free in sntp_close_async
• #110866 - net: dns: .local suffix check reads past the end of the hostname string
• #110915 - pb-adv bearer resets the protocol timer unconditionally
• #110954 - drivers: disk: ftl: dhara callbacks write through NULL error pointer on flash error
• #110956 - Bluetooth: ISO: bt_iso_recv() pulls the SDU header without checking buf->len
• #110967 - Bluetooth: BAP: Broadcast Assistant shares one att_buf across all connections
• #111016 - kernel: userspace: dynamic kernel-object list freed under a different lock than it is traversed
• #111020 - usb: host: ctx->root left dangling after root device disconnect
• #111031 - tests/drivers/can/api/drivers.can.api fails on mutex
• #111032 - tests/net/lib/tls_credentials/net.tls_credentials.trusted_tfm fails on mutex
• #111056 - Wireguard replay issue
• #111082 - net: wireguard: incoming data packet can overflow the linearization buffer
• #111087 - kernel: k_thread_name_copy() syscall dereferences NULL for an unregistered thread pointer
• #111100 - kernel: pipe: a user thread can re-initialize a pipe that is already in use
• #111110 - kernel: poll: z_vrfy_k_poll() leaks events_copy when a k_poll_event carries an invalid object handle
• #111116 - pmci: mctp: I2C+GPIO target writes received bytes through an unchecked/unallocated packet buffer
• #111119 - drivers: spi: dw: spi_dw_configure() uses config->frequency as a divisor without validating it
• #111238 - net: http: server: spurious zsock_poll() return of 0 leaks sockets and corrupts the kernel timeout list
• #111277 - Neighbor solicitation header hop limit issue when CONFIG_NET_IPV6_ROUTE_MCAST is enabled
• #111345 - net: http_server: static filesystem handler serves files outside the web root for paths containing ".."
• #111407 - kernel: userspace: thread_idx_alloc() races on SMP and can hand out duplicate thread indices
• #111411 - ESP32-S3 + Octal PSRAM: runtime flash erase/write fails with ESP_ERR_NOT_FOUND (261) — esp_flash driver chip initialized before PSRAM re-tunes MSPI
• #111412 - drivers: i2c: i2c_dw: target stays stuck in CMD_SEND, write_requested() stops firing
• #111416 - logging: z_vrfy_log_filter_set() accepts a negative src_id and indexes outside log_dynamic
• #111420 - debug: coredump/shell: out-of-bounds read printing a stored coredump's target
• #111427 - bluetooth: host: gatt_write_ccc_rsp() uses subscription params after releasing them
• #111431 - net: ip: forwarded packets keep their original TTL / hop-limit (no decrement on the routing path)
• #111447 - tests: arch: arm: Exclude custom IRQ controllers from IRQ test
• #111481 - drivers: display: display_ili9xxx.c: x/y resolution changes breaks sample
• #111534 - Bluetooth: GATT: notify/indicate checks the declaration's permissions, not the value's, when passed a characteristic declaration
• #111545 - hal_espressif Kconfig can cause build to crashes if ZEPHYR_HAL_ESPRESSIF_MODULE_DIR is undefined
• #111564 - bluetooth: host: classic: l2cap_br: Fix conf req/rsp length validation
• #111888 - drivers: pwm: mcux_sctimer: counter stranded when device resumes before first channel config
• #111929 - net: bridge: Memory leak on broadcast, multicast or matching MAC in eth_bridge_input_process.
• #111935 - flash: z_vrfy_flash_copy is missing proper set of K_SYSCALL_DRIVER_FLASH invocations
• #111936 - fs: ext2: Avoid using 0 value inode and block per group in calculations
• #112027 - Bluetooth: esp32c3: bonding with pairing keys on Zephyr 4.4.1 hangs
• #112204 - net: sockets: recvmsg() ancillary write checks total buffer, not room at the chosen slot
• #112211 - Bluetooth: BAP: UC: NULL stream->group dereference on QoS Configured notification
• #112235 - az3166_iotdevkit: Button B never gets released
• #112315 - fs: ext2: Lack of validation of s_block_count, read from superblock, permitted block bitmap to be larger than ext2 block size
• #112325 - Out-of-bounds read in PTP receive path: unchecked 4-bit message type indexes
• #112421 - net: dhcp: name-lookup bounds checks use sizeof() instead of ARRAY_SIZE()
• #112424 - net: ocpp: RPC-frame field parsing reads past fixed buffers on long/unterminated input
• #112427 - mgmt: hawkbit: 1-byte heap overrun when NUL-terminating the response buffer
• #112430 - Bluetooth: Host: bt_att_sent dereferences a freed channel after disconnect mid-transfer
• #112432 - drivers: flash: sf32lb_mpi_qspi_nor: read/write offset check wraps on a negative offset
• #112435 - kernel: k_queue_peek_head()/k_queue_peek_tail() dereference a node without holding the queue lock
• #112441 - mgmt: updatehub: socket leak, NULL deref, and concurrency bugs in the OTA client
• #112478 - mcuboot: RAM load with revert images are not bootable
• #112555 - drivers: bluetooth: hci_bflb / hci_bee: send() consumes the buffer on error paths
• #112559 - usb: device_next: dfu: handle_download() dereferences buf without a NULL check
• #112609 - drivers: usb: udc: MAX32 USB driver problem about nodata setup messages
• #112613 - usb: device_next: CDC NCM to-host control handler ignores wLength when building responses
• #112616 - net: sockets: userspace sendmsg/recvmsg verifiers re-read live user msghdr after copying it
• #112621 - llext: ELF loader indexes arrays and sizes a stack VLA from unvalidated module header fields
• #112782 - mgmt/settings: heap buffers leaked on access-hook and OOM paths in settings read/write/delete
• #112838 - Bluetooth: Host: GATT: parse_read_std_char_desc() loops forever when a Read By Type Response has len 0
• #112852 - logging: z_vrfy_z_log_msg_static_create() does not validate its arguments
• #112931 - serial: pl011: error interrupts are never acknowledged and stay latched
• #113039 - drivers: modem: hl7800 and wncm14a2a AT-response handlers write past fixed stack buffers
• #113043 - net: 6lo: get_ihpc_inlined_size() reads past da_inline_size_table for reserved destination modes
• #113048 - net: ipv6: handle_ra_6co() underflows memset length for context_len > 128
• #113159 - LVGL Dynamic allocation doesn't work
• #113216 - The issue in Bluetooth Mesh solicitation PDU decryption
• #113265 - Bluetooth: Host: AoD 2US CTE type not validated in valid_conn_cte_tx_params()
• #113266 - kernel: thread: thread_obj_validate() fails to oops a denied k_thread_join/k_thread_abort
• #113299 - net: route: net_route_packet_if() forwards packets without decrementing the hop limit
• #113303 - wifi: airoc: TX net_buf is leaked when whd_network_send_ethernet_data() fails
• #113307 - mbox: userspace: z_vrfy_mbox_send validates msg->data then forwards the mutable userspace pointer
• #113324 - fs: ext2: mount does not validate superblock s_log_block_size
• #113328 - net: ocpp: server-message parsers mishandle malformed and oversized fields
• #113339 - midi2: UMP Stream notification replies transmit uninitialised stack bytes
• #113343 - drivers: virtio: device-supplied ring id and PCI cap_len used without bounds checking
• #113346 - bluetooth: audio: has: notification work runs with NULL attributes when a bonded peer reconnects before bt_has_register()
• #113352 - net: ptp: MGMT_TIME management TLV is parsed without a length check
• #113354 - lorawan: services parse downlink commands without checking remaining payload length
• #113435 - i3c: ibi: data race on the IBI work node free-list between ISR and workqueue thread
• #113443 - net: lwm2m: JSON get_string() writes the NUL terminator one byte past the buffer
• #113464 - Secure Storage nonce generation is not thread-safe
• #113521 - drivers: wifi: siwx91x: TX path unrefs a caller-owned net_pkt
• #113568 - driver: esp32_spi: esp p4 derrives wrong SPI clock
• #113653 - net: ipv6: NS packet is leaked when the neighbor already has a pending packet
• #113684 - net: ipv6: Zero reachable time from Router Advertisement assertion
• #113695 - drivers: i2c: it51xxx: target FIFO ISR writes past target_in_buffer on an oversized write transaction
• #113698 - bluetooth: classic: l2cap: BR/EDR receive path processes data on channels that are not yet established
• #113702 - drivers: modem: hl78xx: GNSS NMEA match data is not the first member of hl78xx_gnss_data
• #113712 - net: mqtt_sn: NULL dereference in process_ping() when a gateway stops responding
• #113729 - sd: sdio: byte-I/O loop spins forever when a card reports max_blk_size == 0
• #113735 - net: sockets: tls: concurrent client sockets race on the shared session cache
• #113755 - net: ocpp: atoi() is called on an unchecked strtok_r() result when a CALLRESULT uid has no second token
• #113845 - drivers: udc: it82xx2: OUT-transfer buffer reuse and suspend-work re-init corrupt kernel state
• #114085 - drivers: display: ls0xx: releases SPI bus too soon
• #114233 - net: bridge: RX net_pkt is leaked when a bridged frame is kept for local processing
• #114320 - rtio: syscall verifiers dereference unvalidated user pointers in sqe_cancel() and sqe_copy_in_get_handles()
• #114337 - net: gptp: receive path dereferences and iterates past the received packet data
• #114495 - drivers: can: stm32: bxcan: maximum filter ID should not take split-filter banks into consideration
• #114502 - usb: host: configuration descriptor is freed twice when enumeration fails
• #114506 - drivers: tgpio: tgpio_pin_read_ts_ec handler does not validate its output pointers
• #114514 - drivers: ipm: ipm_sedi: inbound message length is not validated before the RX copy
• #114522 - smbus: remove_cb syscalls forward an unvalidated user pointer into the driver
• #114526 - drivers: wifi: esp_hosted: RX path parses an unvalidated TLV length and can permanently stop the event thread
• #114586 - drivers/entropy/mcux_trng: poisons xoshiro128 with all-zero seed -> all TCP breaks (-EADDRINUSE)
• #114678 - net: sockets: Kernel crash (bus fault) on TCP listening socket when interface flaps twice
• #114895 - net: ieee802154: unchecked copy into the TX frame buffer, and one MAC frame per net_buf
• #114902 - net: coap: match_path_uri() reads past the end of the Uri-Query value
• #114906 - zbus: proxy_agent: IPC receive callback reads past channel_name[] when logging a rejected frame
• #114978 - drivers: adc: MCUX LPADC and MAX32 write samples past the end of the adc_sequence buffer
• #115025 - mgmt: mcumgr: transport: serial: Check for minimum size of data