Issues fixed
These GitHub issues were addressed since the previous 4.4.1 tagged release:
- #103831 - Add mcxc242 lpuart dma support (async api)
- #104900 - Bluetooth LE host qualification for 4.4 release
- #104922 - drivers: nuvoton: hs usbd: control cmds stuck naking
- #106334 - Thread-safety race condition in net_buf_unref
- #107374 - ESP32 S3 doesn't boot if
CONFIG_ESP32_WIFI_NET_ALLOC_SPIRAMis combined withCONFIG_SPI - #107633 - USB-Next: CDC-ACM: Incomplete transmission on MCUmgr
- #108120 - STM32WBAx : Flash process request is not handled
- #108637 - tests/drivers/bbram/generic/ fails at random due to drivers/bbram/bbram_microchip_mcp7940n_emul.c
- #108793 - kernel: init: main thread not tagged K_FP_REGS when CONFIG_FPU && CONFIG_FPU_SHARING
- #109128 - fs: backend file resource leak when fs_open with FS_O_TRUNC fails during truncate
- #109383 - stm32wbax: bluetooth: issue when extended Advertising Data Packet length exceeds 250 bytes
- #109403 - net: icmpv6: missing source address guard in net_icmpv6_send_error (RFC 4443 2.4(e.6))
- #109460 - entropy: psa:
ENTROPY_PSA_CRYPTO_RNGdeprecated without migration path - #109602 - espressif: esp32c5/esp32s3: fix PSRAM + Wi-Fi heap mapping and linker segment sizing bugs
- #109641 -
west spdxfails on Windows if project is on a different drive - #109907 - tests: dma: chan_blen_transfer: test case is not synchronized with transfer callback
- #110018 - drivers: gpio: esp32: GPIO deep sleep wakeup requires CONFIG_PM
- #110077 - k_pipe_read in ISR causing fault
- #110303 - Bluetooth: Mesh: PrivateBeaconKey PSA key leak after subnet deletion
- #110643 - drivers: stepper: adi_tmc: tmc51xx configure_ramp appears to use child device for clock lookup
- #110645 - net: sockets: recvmsg() ancillary-data capacity check undercounts cmsg size
- #110651 - usb: device_next: cdc_ncm: TX thread deadlocks when usbd_ep_enqueue() fails
- #110654 - drivers: can: nxp: flexcan: bus errors when transmitting leads to log flooding
- #110749 - drivers: uart: sercom g1: async RX of a 1-byte buffer writes one byte past the buffer
- #110757 - xtensa: ptables: deinitialized memory domain is left on the global domain list
- #110762 - bluetooth: classic: hfp_hf: cind_handle_values() writes past ind_table on a long +CIND list
- #110766 - drivers: serial: pl011: TX enable spins forever when CTS flow control blocks transmission
- #110771 - net: sockets: getaddrinfo() retry after a DNS timeout leaves the previous query in flight and touches stale stack state
- #110775 - Bluetooth: BAP: unicast client dereferences NULL stream->qos when a QoS Configured notification arrives before the stream is added to a group
- #110849 - bluetooth: classic: sdp: bt_sdp_parse_attribute() reads one byte past the buffer end
- #110854 - bluetooth: classic: rfcomm: session stuck and L2CAP channel leaked when both sides disconnect simultaneously
- #110857 - net: sntp: close-while-polling use-after-free in
sntp_close_async - #110866 - net: dns:
.localsuffix check reads past the end of the hostname string - #110915 - pb-adv bearer resets the protocol timer unconditionally
- #110954 - drivers: disk: ftl: dhara callbacks write through NULL error pointer on flash error
- #110956 - Bluetooth: ISO: bt_iso_recv() pulls the SDU header without checking buf->len
- #110967 - Bluetooth: BAP: Broadcast Assistant shares one att_buf across all connections
- #111016 - kernel: userspace: dynamic kernel-object list freed under a different lock than it is traversed
- #111020 - usb: host: ctx->root left dangling after root device disconnect
- #111031 - tests/drivers/can/api/drivers.can.api fails on mutex
- #111032 - tests/net/lib/tls_credentials/net.tls_credentials.trusted_tfm fails on mutex
- #111056 - Wireguard replay issue
- #111082 - net: wireguard: incoming data packet can overflow the linearization buffer
- #111087 - kernel: k_thread_name_copy() syscall dereferences NULL for an unregistered thread pointer
- #111100 - kernel: pipe: a user thread can re-initialize a pipe that is already in use
- #111110 - kernel: poll: z_vrfy_k_poll() leaks events_copy when a k_poll_event carries an invalid object handle
- #111116 - pmci: mctp: I2C+GPIO target writes received bytes through an unchecked/unallocated packet buffer
- #111119 - drivers: spi: dw: spi_dw_configure() uses config->frequency as a divisor without validating it
- #111238 - net: http: server: spurious zsock_poll() return of 0 leaks sockets and corrupts the kernel timeout list
- #111277 - Neighbor solicitation header hop limit issue when CONFIG_NET_IPV6_ROUTE_MCAST is enabled
- #111345 - net: http_server: static filesystem handler serves files outside the web root for paths containing ".."
- #111407 - kernel: userspace: thread_idx_alloc() races on SMP and can hand out duplicate thread indices
- #111411 - ESP32-S3 + Octal PSRAM: runtime flash erase/write fails with ESP_ERR_NOT_FOUND (261) — esp_flash driver chip initialized before PSRAM re-tunes MSPI
- #111412 - drivers: i2c: i2c_dw: target stays stuck in CMD_SEND, write_requested() stops firing
- #111416 - logging: z_vrfy_log_filter_set() accepts a negative src_id and indexes outside log_dynamic
- #111420 - debug: coredump/shell: out-of-bounds read printing a stored coredump's target
- #111427 - bluetooth: host: gatt_write_ccc_rsp() uses subscription params after releasing them
- #111431 - net: ip: forwarded packets keep their original TTL / hop-limit (no decrement on the routing path)
- #111447 - tests: arch: arm: Exclude custom IRQ controllers from IRQ test
- #111481 - drivers: display: display_ili9xxx.c: x/y resolution changes breaks sample
- #111534 - Bluetooth: GATT: notify/indicate checks the declaration's permissions, not the value's, when passed a characteristic declaration
- #111545 - hal_espressif Kconfig can cause build to crashes if ZEPHYR_HAL_ESPRESSIF_MODULE_DIR is undefined
- #111564 - bluetooth: host: classic: l2cap_br: Fix conf req/rsp length validation
- #111888 - drivers: pwm: mcux_sctimer: counter stranded when device resumes before first channel config
- #111929 - net: bridge: Memory leak on broadcast, multicast or matching MAC in eth_bridge_input_process.
- #111935 - flash: z_vrfy_flash_copy is missing proper set of K_SYSCALL_DRIVER_FLASH invocations
- #111936 - fs: ext2: Avoid using 0 value inode and block per group in calculations
- #112027 - Bluetooth: esp32c3: bonding with pairing keys on Zephyr 4.4.1 hangs
- #112204 - net: sockets: recvmsg() ancillary write checks total buffer, not room at the chosen slot
- #112211 - Bluetooth: BAP: UC: NULL stream->group dereference on QoS Configured notification
- #112235 - az3166_iotdevkit: Button B never gets released
- #112315 - fs: ext2: Lack of validation of s_block_count, read from superblock, permitted block bitmap to be larger than ext2 block size
- #112325 - Out-of-bounds read in PTP receive path: unchecked 4-bit message type indexes
- #112421 - net: dhcp: name-lookup bounds checks use sizeof() instead of ARRAY_SIZE()
- #112424 - net: ocpp: RPC-frame field parsing reads past fixed buffers on long/unterminated input
- #112427 - mgmt: hawkbit: 1-byte heap overrun when NUL-terminating the response buffer
- #112430 - Bluetooth: Host: bt_att_sent dereferences a freed channel after disconnect mid-transfer
- #112432 - drivers: flash: sf32lb_mpi_qspi_nor: read/write offset check wraps on a negative offset
- #112435 - kernel: k_queue_peek_head()/k_queue_peek_tail() dereference a node without holding the queue lock
- #112441 - mgmt: updatehub: socket leak, NULL deref, and concurrency bugs in the OTA client
- #112555 - drivers: bluetooth: hci_bflb / hci_bee: send() consumes the buffer on error paths
- #112559 - usb: device_next: dfu: handle_download() dereferences buf without a NULL check
- #112609 - drivers: usb: udc: MAX32 USB driver problem about nodata setup messages
- #112613 - usb: device_next: CDC NCM to-host control handler ignores wLength when building responses
- #112616 - net: sockets: userspace sendmsg/recvmsg verifiers re-read live user msghdr after copying it
- #112621 - llext: ELF loader indexes arrays and sizes a stack VLA from unvalidated module header fields
- #112782 - mgmt/settings: heap buffers leaked on access-hook and OOM paths in settings read/write/delete
- #112838 - Bluetooth: Host: GATT: parse_read_std_char_desc() loops forever when a Read By Type Response has len 0
- #112852 - logging: z_vrfy_z_log_msg_static_create() does not validate its arguments
- #112931 - serial: pl011: error interrupts are never acknowledged and stay latched
- #113039 - drivers: modem: hl7800 and wncm14a2a AT-response handlers write past fixed stack buffers
- #113043 - net: 6lo: get_ihpc_inlined_size() reads past da_inline_size_table for reserved destination modes
- #113048 - net: ipv6: handle_ra_6co() underflows memset length for context_len > 128
- #113159 - LVGL Dynamic allocation doesn't work
- #113265 - Bluetooth: Host: AoD 2US CTE type not validated in valid_conn_cte_tx_params()
- #113266 - kernel: thread: thread_obj_validate() fails to oops a denied k_thread_join/k_thread_abort
- #113299 - net: route: net_route_packet_if() forwards packets without decrementing the hop limit
- #113303 - wifi: airoc: TX net_buf is leaked when whd_network_send_ethernet_data() fails
- #113307 - mbox: userspace: z_vrfy_mbox_send validates msg->data then forwards the mutable userspace pointer
- #113324 - fs: ext2: mount does not validate superblock s_log_block_size
- #113328 - net: ocpp: server-message parsers mishandle malformed and oversized fields
- #113339 - midi2: UMP Stream notification replies transmit uninitialised stack bytes
- #113343 - drivers: virtio: device-supplied ring id and PCI cap_len used without bounds checking
- #113346 - bluetooth: audio: has: notification work runs with NULL attributes when a bonded peer reconnects before bt_has_register()
- #113352 - net: ptp: MGMT_TIME management TLV is parsed without a length check
- #113354 - lorawan: services parse downlink commands without checking remaining payload length
- #113435 - i3c: ibi: data race on the IBI work node free-list between ISR and workqueue thread
- #113443 - net: lwm2m: JSON get_string() writes the NUL terminator one byte past the buffer
- #113464 - Secure Storage nonce generation is not thread-safe
- #113521 - drivers: wifi: siwx91x: TX path unrefs a caller-owned net_pkt
- #113568 - driver: esp32_spi: esp p4 derrives wrong SPI clock
- #113653 - net: ipv6: NS packet is leaked when the neighbor already has a pending packet
- #113684 - net: ipv6: Zero reachable time from Router Advertisement assertion
- #113695 - drivers: i2c: it51xxx: target FIFO ISR writes past target_in_buffer on an oversized write transaction
- #113698 - bluetooth: classic: l2cap: BR/EDR receive path processes data on channels that are not yet established
- #113702 - drivers: modem: hl78xx: GNSS NMEA match data is not the first member of hl78xx_gnss_data
- #113712 - net: mqtt_sn: NULL dereference in process_ping() when a gateway stops responding
- #113729 - sd: sdio: byte-I/O loop spins forever when a card reports max_blk_size == 0
- #113735 - net: sockets: tls: concurrent client sockets race on the shared session cache
- #113755 - net: ocpp: atoi() is called on an unchecked strtok_r() result when a CALLRESULT uid has no second token
- #113845 - drivers: udc: it82xx2: OUT-transfer buffer reuse and suspend-work re-init corrupt kernel state
- #114085 - drivers: display: ls0xx: releases SPI bus too soon
- #114233 - net: bridge: RX net_pkt is leaked when a bridged frame is kept for local processing
- #114320 - rtio: syscall verifiers dereference unvalidated user pointers in sqe_cancel() and sqe_copy_in_get_handles()
- #114337 - net: gptp: receive path dereferences and iterates past the received packet data
- #114495 - drivers: can: stm32: bxcan: maximum filter ID should not take split-filter banks into consideration
- #114502 - usb: host: configuration descriptor is freed twice when enumeration fails
- #114506 - drivers: tgpio: tgpio_pin_read_ts_ec handler does not validate its output pointers
- #114522 - smbus: remove_cb syscalls forward an unvalidated user pointer into the driver
- #114526 - drivers: wifi: esp_hosted: RX path parses an unvalidated TLV length and can permanently stop the event thread