How many CVEs have a located fix in zephyrproject-rtos/zephyr?

186 published CVEs have a fix traced to functions in zephyrproject-rtos/zephyr, touching 557 functions across 223 files.

Which function in zephyrproject-rtos/zephyr has been patched by the most CVEs?

wg_process_data_message in subsys/net/lib/wireguard/wg_crypto.c has been changed by 3 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in zephyrproject-rtos/zephyr?

The median fix changes 13 lines. 63% of fixes change 20 lines or fewer, and 49% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

c

assembly

#11 of 500 repositories

zephyrproject-rtos/zephyr

Name: zephyrproject-rtos/zephyr: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 14, 2026

186

CVE fixes located

Published CVEs

557

Functions patched

Distinct function sites

223

Files patched

Distinct source files

2019–2026

Years covered

By CVE publication date

Overview

186 published CVEs have a fix traced to functions in zephyrproject-rtos/zephyr, the earliest published in 2019. Those fixes changed 557 distinct functions across 223 files, in 1,719 patch hunks.

Among the 500 repositories tracked here, zephyrproject-rtos/zephyr ranks #11 by the number of CVEs with a located fix.

Most patched functions

Functions in zephyrproject-rtos/zephyr changed by the most CVE fixes.

Most patched files

Files in zephyrproject-rtos/zephyr changed by the most CVE fixes.

1subsys/mgmt/updatehub/updatehub.c5 CVEs · 10 functions
2subsys/bluetooth/host/gatt.c4 CVEs · 12 functions
3kernel/userspace/userspace.c4 CVEs · 8 functions
4subsys/fs/ext2/ext2_impl.c4 CVEs · 8 functions
5subsys/net/ip/ipv6_nbr.c4 CVEs · 7 functions
6lib/updatehub/updatehub.c3 CVEs · 18 functions
7subsys/bluetooth/host/att.c3 CVEs · 4 functions
8subsys/net/lib/mqtt/mqtt_decoder.c3 CVEs · 2 functions
9subsys/net/lib/mqtt/mqtt_rx.c3 CVEs · 1 functions
10subsys/net/lib/wireguard/wg_crypto.c3 CVEs · 1 functions

Fix size

How much code a CVE fix in zephyrproject-rtos/zephyr changes, with backports counted once.

13

Median lines changed

Added plus removed, per CVE

63%

Fixes of 20 lines or fewer

Share of CVE fixes

49%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in zephyrproject-rtos/zephyr, and the functions each fix changed.

Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver
CVE-2026-75085stm32wba_802154_rx_thread
Medium · CVSS 4.2
EPSS 0.2%2026-10-14
Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length
CVE-2026-75084verify_rxfifo_validity
Medium · CVSS 6.8
EPSS 0.3%2026-10-14
Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header
CVE-2026-19673net_if
High · CVSS 7.1
EPSS 0.3%2026-10-14
Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver
CVE-2026-75083kw41z_rx
Medium · CVSS 5.9
EPSS 0.2%2026-10-14
Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping
CVE-2026-19940bt_hfp_ag_call
Medium · CVSS 6.5
EPSS 0.2%2026-10-13
Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption
CVE-2026-19939avdtp_send_cmd bt_avdtp_l2cap_disconnected bt_avdtp_connect
Medium · CVSS 6.3
EPSS 0.2%2026-10-13
Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails
CVE-2026-19938again
Medium · CVSS 5.9
EPSS 0.2%2026-10-12
Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses
CVE-2026-19937release_delayable_msg_ctx
Medium · CVSS 5.7
EPSS 0.2%2026-10-12
Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference
CVE-2026-19936complete_delayable_msg push_msg_from_delayable_msgs reschedule_delayable_msg
Medium · CVSS 4.8
EPSS 0.1%2026-10-12
Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
CVE-2026-19740llcp_lp_pu_rx llcp_rp_pu_rx
Medium · CVSS 6.5
EPSS 0.1%2026-10-11
Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
CVE-2026-19739llcp_lp_cu_rx llcp_rp_cu_rx
Medium · CVSS 6.5
EPSS 0.1%2026-10-11
Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
CVE-2026-19738llcp_lp_cc_rx llcp_rp_cc_rx
Medium · CVSS 6.5
EPSS 0.1%2026-10-11

Get an alert for each new zephyrproject-rtos/zephyr CVE, with the patched functions and AI-written analysis.

Monitor zephyr CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

gpac/gpac194 CVEs apache/airflow200 CVEs chakra-core/ChakraCore205 CVEs jenkinsci/jenkins167 CVEs go-gitea/gitea162 CVEs discourse/discourse159 CVEs liferay/liferay-portal159 CVEs vim/vim222 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in zephyrproject-rtos/zephyr.

How many CVEs have a located fix in zephyrproject-rtos/zephyr?: 186 published CVEs have a fix traced to functions in zephyrproject-rtos/zephyr, touching 557 functions across 223 files.
Which function in zephyrproject-rtos/zephyr has been patched by the most CVEs?: wg_process_data_message in subsys/net/lib/wireguard/wg_crypto.c has been changed by 3 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in zephyrproject-rtos/zephyr?: The median fix changes 13 lines. 63% of fixes change 20 lines or fewer, and 49% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track zephyrproject-rtos/zephyr CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing