Executive brief
A vulnerability in the Zephyr operating system's networking component could allow an attacker to crash a device or potentially access sensitive information. The issue occurs when the system manages multiple network connections simultaneously; if a connection is closed at the exact moment the system is listing active connections, it can lead to a memory error. This could disrupt the operation of embedded devices or industrial sensors that rely on Zephyr for communication.
Technical details
A use-after-free vulnerability exists in Zephyr's native TCP stack (TCP2) within `subsys/net/ip/tcp.c`. The `net_tcp_foreach()` function uses the `SYS_SLIST_FOR_EACH_CONTAINER_SAFE` macro to iterate through global TCP connections but releases the `tcp_lock` mutex while executing the per-connection callback. If a concurrent `tcp_conn_release()` execution occurs on the TCP work-queue thread (triggered by a remote peer closing a connection), it can free the 'next' node cached by the iterator. When the iterator resumes, it dereferences this freed memory. This can result in a system crash (DoS) or, if the memory slab is reallocated, execution on attacker-influenced data. The vulnerability is reachable via the 'net conn' shell command or during interface-down events.
Affected products
- Zephyr Project Zephyr RTOS >= 2.5.0, <= 4.4.0
Timeline
- 2020-12-14: other: Vulnerability introduced in commit 9080a46
- 2026-06-13: other: Embargo date
- 2026-06-15: disclosed: Advisory published
- 2026-06-15: patched: Fix merged into main branch