Zephyr Project Files

This is a maintenance release with fixes.

Issues Fixed

These GitHub issues were addressed since the previous 4.3.0 tagged release:

• https://github.com/zephyrproject-rtos/zephyr/issues/55186 - posix: fnmatch: fix known bugs
• https://github.com/zephyrproject-rtos/zephyr/issues/61464 - USB device stack (new and old) assertion on STM32
• https://github.com/zephyrproject-rtos/zephyr/issues/95359 - spi_loopback fails on frdm_rw612 with DMA and/or cs_loopback
• https://github.com/zephyrproject-rtos/zephyr/issues/96699 - drivers: spi: nrf_spim: Unused function warning when CONFIG_DEVICE_DEINIT_SUPPORT is disabled
• https://github.com/zephyrproject-rtos/zephyr/issues/96762 - drivers: serial: uart_nrfx_uarte: Unused function warning when CONFIG_DEVICE_DEINIT_SUPPORT is disabled
• https://github.com/zephyrproject-rtos/zephyr/issues/98491 - riscv: userspace: undefined symbol: z_stack_space_get
• https://github.com/zephyrproject-rtos/zephyr/issues/98501 - pm: device_runtime: Issues with set/clear PD_CLAIMED flag in ISR_SAFE context
• https://github.com/zephyrproject-rtos/zephyr/issues/98523 - ring_buffer: ring_buf_init may trigger assertion depending on Kconfig
• https://github.com/zephyrproject-rtos/zephyr/issues/98588 - drivers: i2c: dw_i2c: i2c read time out on certain type of DW_I2C
• https://github.com/zephyrproject-rtos/zephyr/issues/98768 - STM32F303 bxCAN: Last 2 bytes corrupted on TX pin, but registers are correct
• https://github.com/zephyrproject-rtos/zephyr/issues/98782 - esp32c6: esp32h2: OpenThread issue
• https://github.com/zephyrproject-rtos/zephyr/issues/98797 - boards: nxp: mimxrt1180_evk: J-Link script file not used when debugging
• https://github.com/zephyrproject-rtos/zephyr/issues/99099 - STM32 QSPI sample shifting prevents communication with GD25Q128E flash chip
• https://github.com/zephyrproject-rtos/zephyr/issues/99453 - sensor: current-amp: zero-current-offset no longer works
• https://github.com/zephyrproject-rtos/zephyr/issues/99490 - MAX32650 SoC system clock configuration problem
• https://github.com/zephyrproject-rtos/zephyr/issues/99491 - hwinfo: hwinfo test fails for MAX32657EVKIT board
• https://github.com/zephyrproject-rtos/zephyr/issues/99535 - Issue with STM32 Ethernet and KSZ8081 Phy
• https://github.com/zephyrproject-rtos/zephyr/issues/99563 - RP2350 Hazard3 doesn't default to XIP
• https://github.com/zephyrproject-rtos/zephyr/issues/99588 - Bluetooth: Controller: nRF54Lx Radio Tx Power incorrect
• https://github.com/zephyrproject-rtos/zephyr/issues/99644 - Siwx91x Compilation error with PM
• https://github.com/zephyrproject-rtos/zephyr/issues/99659 - OpenThread Border Router issues in 4.3.0 release
• https://github.com/zephyrproject-rtos/zephyr/issues/99682 - net: lib: dns: Unpacking query name can overflow the destination buffer
• https://github.com/zephyrproject-rtos/zephyr/issues/99762 - mcumgr: Image management incorrectly identifies active slot when slots are on different flash devices
• https://github.com/zephyrproject-rtos/zephyr/issues/99792 - HTTP Server Shows Error Log Message when iface goes down
• https://github.com/zephyrproject-rtos/zephyr/issues/99795 - Telnet Shell Server Shows Error Log Message when iface goes down
• https://github.com/zephyrproject-rtos/zephyr/issues/99797 - MCUmgr: OS: DateTime: Millisecond parsing erroneous
• https://github.com/zephyrproject-rtos/zephyr/issues/99822 - stm32 EXTI driver: add support for STM32N6
• https://github.com/zephyrproject-rtos/zephyr/issues/99895 - npcx9m6f_evb and frdm_k64f: kernel.common.stack_protection_arm_fpu_sharing fails
• https://github.com/zephyrproject-rtos/zephyr/issues/99901 - drivers: entropy: gecko_trng: Error when getting entropy too soon after init
• https://github.com/zephyrproject-rtos/zephyr/issues/99904 - soc: silabs: siwx91x: irq prio misalignment with hal
• https://github.com/zephyrproject-rtos/zephyr/issues/99948 - drivers: ice40_fpga: k_usleep while holding a spinlock
• https://github.com/zephyrproject-rtos/zephyr/issues/100040 - timer: cortex_m_systick: Compilation error if CONFIG_TIMER_READS_ITS_FREQUENCY_AT_RUNTIME is defined
• https://github.com/zephyrproject-rtos/zephyr/issues/100211 - soc: silabs: siwx91x: ADC driver returns constant 0 mV
• https://github.com/zephyrproject-rtos/zephyr/issues/100212 - No event code filterint for LVGL pointer process
• https://github.com/zephyrproject-rtos/zephyr/issues/100225 - bluetooth: bt_conn reference leak in Frame Space Update in Zephyr 4.3.0
• https://github.com/zephyrproject-rtos/zephyr/issues/100296 - west packages pip --install fails with permission error
• https://github.com/zephyrproject-rtos/zephyr/issues/100715 - mgmt: mcumgr: firmware loader allows for self erasure
• https://github.com/zephyrproject-rtos/zephyr/issues/100754 - bt test commands not working/crashing for nRF54LM20A DK board
• https://github.com/zephyrproject-rtos/zephyr/issues/100903 - drivers: flash: stm32 ospi: detected erase type is always resetted
• https://github.com/zephyrproject-rtos/zephyr/issues/101048 - drivers: xen: Uninitialized variable warning
• https://github.com/zephyrproject-rtos/zephyr/issues/101151 - drivers: serial: NXP uart_mcux_flexcomm: instance interrupt config not saved during PM_DEVICE_ACTION_TURN_OFF
• https://github.com/zephyrproject-rtos/zephyr/issues/101236 - NXP: Failed to disable random-mac-address in ethernet driver.
• https://github.com/zephyrproject-rtos/zephyr/issues/101401 - logging: thread starvation for lower-priority producers
• https://github.com/zephyrproject-rtos/zephyr/issues/101414 - ZVFS_OPEN_SIZE define applied irrespective of configuration
• https://github.com/zephyrproject-rtos/zephyr/issues/101416 - It seems TCP accept had some issue during link changes
• https://github.com/zephyrproject-rtos/zephyr/issues/102129 - Flash incorrectly tested on MAX32657 NS due to storage_partition
• https://github.com/zephyrproject-rtos/zephyr/issues/102635 - gpio: mcux: Potential infinite interrupt hang when configuring
• https://github.com/zephyrproject-rtos/zephyr/issues/102995 - OpenThread: build fails with CONFIG_OPENTHREAD_MTD enabled
• https://github.com/zephyrproject-rtos/zephyr/issues/103029 - NVS startup fails after power loss during final ATE write
• https://github.com/zephyrproject-rtos/zephyr/issues/103140 - TCAN4x5x initialization stalls with latest driver changes
• https://github.com/zephyrproject-rtos/zephyr/issues/103239 - Race condition on usart/eusart silabs driver
• https://github.com/zephyrproject-rtos/zephyr/issues/103242 - Watchdog timer on Siwx91x devices is not on pause during deep sleep
• https://github.com/zephyrproject-rtos/zephyr/issues/103329 - Shared Flash access might be corrupted on SiWx91x SoC
• https://github.com/zephyrproject-rtos/zephyr/issues/103339 - PM on SiWG91x SoC is broken
• https://github.com/zephyrproject-rtos/zephyr/issues/103365 - MAX32655 UART fails to send some bytes on Zephyr 4.3
• https://github.com/zephyrproject-rtos/zephyr/issues/103962 - RTIO: SQE flags not zeroed by some functions
• https://github.com/zephyrproject-rtos/zephyr/issues/104208 - IPv4/6 fragmentation memory leak
• https://github.com/zephyrproject-rtos/zephyr/issues/104248 - DNS query packet length check
• https://github.com/zephyrproject-rtos/zephyr/issues/104253 - driver: clock_control: RCC_BDCR_LSEDRV_Pos undefined using STM32L0
• https://github.com/zephyrproject-rtos/zephyr/issues/104652 - net: socketcan: length not always verified
• https://github.com/zephyrproject-rtos/zephyr/issues/104748 - mcumgr: error codes of group "stat" incorrect
• https://github.com/zephyrproject-rtos/zephyr/issues/104948 - net: lib: socket: tls: Potential out-of-bounds write in socket_op_vtable.connect
• https://github.com/zephyrproject-rtos/zephyr/issues/105038 - net: lib: sockets: tls: Improve socket address storage
• https://github.com/zephyrproject-rtos/zephyr/issues/105106 - arc: mpu: MPUv6 buffer validation race condition causes spurious access denials
• https://github.com/zephyrproject-rtos/zephyr/issues/105216 - drivers: timer: stm32_lptim: fix incorrect configuration and harden against wrong usage
• https://github.com/zephyrproject-rtos/zephyr/issues/105374 - drivers: gpio: sam: callback called when interrupt disabled
• https://github.com/zephyrproject-rtos/zephyr/issues/105644 - SNTP uncertainty option invalids sntp_query
• https://github.com/zephyrproject-rtos/zephyr/issues/105754 - net: sockets: msg->msg_iovlen is not validated in zsock_recvmsg sys call
• https://github.com/zephyrproject-rtos/zephyr/issues/106109 - wifi: wifi_credentials: Static credentials are not validated
• https://github.com/zephyrproject-rtos/zephyr/issues/106291 - Build fails when CONFIG_OPENTHREAD_CONFIG_DIAG_ENABLE is enabled.
• https://github.com/zephyrproject-rtos/zephyr/issues/106334 - Thread-safety race condition in net_buf_unref
• https://github.com/zephyrproject-rtos/zephyr/issues/106776 - net: tcp: Non-blocking connect failure leaks SYN retransmissions
• https://github.com/zephyrproject-rtos/zephyr/issues/106894 - update Mbed TLS to 3.6.6
• https://github.com/zephyrproject-rtos/zephyr/issues/106991 - net: tcp: use-after-free in net_tcp_foreach causes bus fault
• https://github.com/zephyrproject-rtos/zephyr/issues/107081 - McuMgr fs_mgmt_file_upload handler does not check partial writes to filesystem
• https://github.com/zephyrproject-rtos/zephyr/issues/107096 - cc3220sf_launchxl/cc3220sf missing ZVFS selection in sample
• https://github.com/zephyrproject-rtos/zephyr/issues/107900 - net: ipv6: Neighbor Discovery packets validation is incorrect
• https://github.com/zephyrproject-rtos/zephyr/issues/107920 - net: icmp: assert triggered sending icmp echo response with CONFIG_NET_STATISTICS
• https://github.com/zephyrproject-rtos/zephyr/issues/107928 - net: lib: http_server: fix in websocket
• https://github.com/zephyrproject-rtos/zephyr/issues/108004 - drivers: entropy: stm32: bad locking sequence
• https://github.com/zephyrproject-rtos/zephyr/issues/108149 - Renaming configuration file in WiFi Shell sample causes errors when building the associated board documentation
• https://github.com/zephyrproject-rtos/zephyr/issues/108559 - IP address parsing issue
• https://github.com/zephyrproject-rtos/zephyr/issues/108637 - tests/drivers/bbram/generic/ fails at random due to drivers/bbram/bbram_microchip_mcp7940n_emul.c
• https://github.com/zephyrproject-rtos/zephyr/issues/108835 - adin2111: Communication gets stuck after high bandwidth transfer
• https://github.com/zephyrproject-rtos/zephyr/issues/108846 - Validate DNS rdata length in dns_unpack_answer
• https://github.com/zephyrproject-rtos/zephyr/issues/108848 - wifi: nrf70: Missing bounds check on TWT event buffer
• https://github.com/zephyrproject-rtos/zephyr/issues/108963 - net: lwm2m: URI string may be unterminated in FW pull mode
• https://github.com/zephyrproject-rtos/zephyr/issues/109053 - native_sim: FUSE files are opened write-only
• https://github.com/zephyrproject-rtos/zephyr/issues/109063 - The issue in Bluetooth Mesh solicitation PDU parsing
• https://github.com/zephyrproject-rtos/zephyr/issues/109128 - fs: backend file resource leak when fs_open with FS_O_TRUNC fails during truncate
• https://github.com/zephyrproject-rtos/zephyr/issues/109133 - Undefined bitwise shift behavior in PTP port management interval handling
• https://github.com/zephyrproject-rtos/zephyr/issues/109257 - xtensa: mpu: fix arch_buffer_validate on overflow
• https://github.com/zephyrproject-rtos/zephyr/issues/109549 - Security advisory GHSA-4vqm-pw24-g9jp / CVE 2026-5590 fix not available for Zephyr 4.3
• https://github.com/zephyrproject-rtos/zephyr/issues/109620 - Bluetooth: Controller: Fix OOB read in ISOAL
• https://github.com/zephyrproject-rtos/zephyr/issues/109857 - posix: mqueue: fix integer overflow in mq_open buffer allocation
• https://github.com/zephyrproject-rtos/zephyr/issues/110032 - fs: ext2: validate directory entry structure before traversal
• https://github.com/zephyrproject-rtos/zephyr/issues/110077 - k_pipe_read in ISR causing fault
• https://github.com/zephyrproject-rtos/zephyr/issues/110303 - Bluetooth: Mesh: PrivateBeaconKey PSA key leak after subnet deletion
• https://github.com/zephyrproject-rtos/zephyr/issues/110393 - bluetooth: l2cap: validate alloc_buf user data
• https://github.com/zephyrproject-rtos/zephyr/issues/110645 - net: sockets: zsock_recvmsg ancillary-data capacity check undercounts cmsg size
• https://github.com/zephyrproject-rtos/zephyr/issues/110651 - usb: device_next: cdc_ncm: TX thread deadlocks when usbd_ep_enqueue fails
• https://github.com/zephyrproject-rtos/zephyr/issues/110762 - bluetooth: classic: hfp_hf: cind_handle_values writes past ind_table on a long +CIND list
• https://github.com/zephyrproject-rtos/zephyr/issues/110766 - drivers: serial: pl011: TX enable spins forever when CTS flow control blocks transmission
• https://github.com/zephyrproject-rtos/zephyr/issues/110771 - net: sockets: zsock_getaddrinfo retry after a DNS timeout leaves the previous query in flight and touches stale stack state
• https://github.com/zephyrproject-rtos/zephyr/issues/110775 - Bluetooth: BAP: unicast client dereferences NULL stream->qos when a QoS Configured notification arrives before the stream is added to a group
• https://github.com/zephyrproject-rtos/zephyr/issues/110857 - net: sntp: close-while-polling use-after-free in sntp_close_async
• https://github.com/zephyrproject-rtos/zephyr/issues/110866 - net: dns: .local suffix check reads past the end of the hostname string
• https://github.com/zephyrproject-rtos/zephyr/issues/110915 - pb-adv bearer resets the protocol timer unconditionally
• https://github.com/zephyrproject-rtos/zephyr/issues/110956 - Bluetooth: ISO: bt_iso_recv pulls the SDU header without checking buf->len
• https://github.com/zephyrproject-rtos/zephyr/issues/110967 - Bluetooth: BAP: Broadcast Assistant shares one att_buf across all connections
• https://github.com/zephyrproject-rtos/zephyr/issues/111016 - kernel: userspace: dynamic kernel-object list freed under a different lock than it is traversed
• https://github.com/zephyrproject-rtos/zephyr/issues/111031 - tests/drivers/can/api/drivers.can.api fails on mutex
• https://github.com/zephyrproject-rtos/zephyr/issues/111087 - kernel: userspace: k_thread_name_copy syscall dereferences NULL for an unregistered thread pointer
• https://github.com/zephyrproject-rtos/zephyr/issues/111100 - kernel: pipe: a user thread can re-initialize a pipe that is already in use
• https://github.com/zephyrproject-rtos/zephyr/issues/111110 - kernel: poll: z_vrfy_k_poll leaks events_copy when a k_poll_event carries an invalid object handle
• https://github.com/zephyrproject-rtos/zephyr/issues/111116 - pmci: mctp: I2C+GPIO target writes received bytes through an unchecked/unallocated packet buffer
• https://github.com/zephyrproject-rtos/zephyr/issues/111119 - drivers: spi: dw: spi_dw_configure uses config->frequency as a divisor without validating it
• https://github.com/zephyrproject-rtos/zephyr/issues/111345 - net: http_server: static filesystem handler serves files outside the web root for paths containing ".."
• https://github.com/zephyrproject-rtos/zephyr/issues/111416 - logging: z_vrfy_log_filter_set accepts a negative src_id and indexes outside log_dynamic
• https://github.com/zephyrproject-rtos/zephyr/issues/111431 - net: ip: forwarded packets keep their original TTL / hop-limit (no decrement on the routing path)
• https://github.com/zephyrproject-rtos/zephyr/issues/111534 - Bluetooth: GATT: notify/indicate checks the declaration permissions, not the value permissions, when passed a characteristic declaration
• https://github.com/zephyrproject-rtos/zephyr/issues/111564 - bluetooth: host: classic: l2cap_br: fix conf req/rsp length validation
• https://github.com/zephyrproject-rtos/zephyr/issues/111420 - debug: coredump/shell: check tgt code before using string array

Security Vulnerability Related

The following security vulnerabilities (CVEs) were addressed in this release:

• https://www.cve.org/CVERecord?id=CVE-2026-7656: Under embargo until 2026-06-25
• https://www.cve.org/CVERecord?id=CVE-2026-8023: Under embargo until 2026-06-23
• https://www.cve.org/CVERecord?id=CVE-2026-9263: Under embargo until 2026-06-28
• https://www.cve.org/CVERecord?id=CVE-2026-10593: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10634: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6c57-xfhw-j26x
• https://www.cve.org/CVERecord?id=CVE-2026-10636: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj6q-975v-65c9
• https://www.cve.org/CVERecord?id=CVE-2026-10637: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m23w-34pp-4h92
• https://www.cve.org/CVERecord?id=CVE-2026-10638: Under embargo until 2026-08-20
• https://www.cve.org/CVERecord?id=CVE-2026-10639: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qhrf-w466-qmpw
• https://www.cve.org/CVERecord?id=CVE-2026-10640: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r74c-mr4m-7g9g
• https://www.cve.org/CVERecord?id=CVE-2026-10641: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wx5j-q6f2-59p3
• https://www.cve.org/CVERecord?id=CVE-2026-10642: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10643: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10645: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hwrh-9h3x-vccm
• https://www.cve.org/CVERecord?id=CVE-2026-10646: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10647: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10651: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p93g-3r68-cj53
• https://www.cve.org/CVERecord?id=CVE-2026-10652: Under embargo until 2026-07-22
• https://www.cve.org/CVERecord?id=CVE-2026-10653: Under embargo until 2026-08-21
• https://www.cve.org/CVERecord?id=CVE-2026-10654: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10655: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10657: Under embargo until 2026-08-20
• https://www.cve.org/CVERecord?id=CVE-2026-10658: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-26g8-rmpf-j6cw
• https://www.cve.org/CVERecord?id=CVE-2026-10660: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10664: Under embargo until 2026-06-28
• https://www.cve.org/CVERecord?id=CVE-2026-10666: Under embargo until 2026-07-09
• https://www.cve.org/CVERecord?id=CVE-2026-10667: Under embargo until 2026-07-11
• https://www.cve.org/CVERecord?id=CVE-2026-10669: Under embargo until 2026-08-20
• https://www.cve.org/CVERecord?id=CVE-2026-10670: Under embargo until 2026-08-20
• https://www.cve.org/CVERecord?id=CVE-2026-10671: Under embargo until 2026-08-20
• https://www.cve.org/CVERecord?id=CVE-2026-10672: Under embargo until 2026-06-25
• https://www.cve.org/CVERecord?id=CVE-2026-10673: Under embargo until 2026-07-15
• https://www.cve.org/CVERecord?id=CVE-2026-10674: Under embargo until 2026-08-28
• https://www.cve.org/CVERecord?id=CVE-2026-10675: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10677: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10678: Under embargo until 2026-08-21
• https://www.cve.org/CVERecord?id=CVE-2026-10679: Under embargo until 2026-08-26
• https://www.cve.org/CVERecord?id=CVE-2026-10680: Under embargo until 2026-08-09
• https://www.cve.org/CVERecord?id=CVE-2026-10682: Under embargo until 2026-08-25
• https://www.cve.org/CVERecord?id=CVE-2026-10684: Under embargo until 2026-08-28
• https://www.cve.org/CVERecord?id=CVE-2026-10686: Under embargo until 2026-08-30
• https://www.cve.org/CVERecord?id=CVE-2026-10772: Under embargo until 2026-09-01
• https://www.cve.org/CVERecord?id=CVE-2026-10774: Under embargo until 2026-09-01

More detailed information can be found here: https://docs.zephyrproject.org/latest/security/vulnerabilities.html