Zephyr

This release fixes several CVEs including a Bluetooth GATT permission bypass that skipped encryption/authentication checks, an out-of-bounds heap write in the recvmsg() ancillary-data path, and a use-after-free in SMP dynamic kernel-object tracking reachable from unprivileged user threads, along with fixes for a thread_idx_alloc() race that could hand out duplicate thread indices and a socket leak in the HTTP server poll handling.

Matters for: Teams running Zephyr 3.7 LTS on multicore SMP boards with CONFIG_USERSPACE enabled or using Bluetooth GATT and BR/EDR L2CAP stacks.

Zephyr 4.4.2 fixes numerous disclosed vulnerabilities including out-of-bounds writes, use-after-free, and NULL-pointer dereferences across Bluetooth (LE Audio, HFP, Classic, ISO, Mesh), USB device/host stacks, networking (recvmsg, SNTP, WireGuard, DNS resolver), filesystem (ext2, Dhara FTL), and kernel userspace object handling. Devices running earlier 4.4.x releases should upgrade to 4.4.2 to close these remotely and locally triggerable DoS, information-disclosure, and memory-corruption issues.

Matters for: Engineers building embedded products with Zephyr's Bluetooth LE/Classic stacks, USB host/device stacks, or networking features (HTTP server, WireGuard, DNS, SNTP) exposed to untrusted peers.