Executive brief
Zephyr, a real-time operating system used in embedded and IoT devices, contains a memory safety flaw in its networking component. An attacker can send a specially crafted network packet to a device, causing it to crash or potentially allowing the attacker to gain unauthorized control over the system. This could lead to service outages or the compromise of sensitive data handled by the device.
Technical details
A heap-based buffer overflow exists in Zephyr's IP socket implementation within `subsys/net/lib/sockets/sockets_inet.c`. The `insert_pktinfo()` function validates user-supplied ancillary buffers (`msg_control`) using only the payload length while ignoring the size of the `cmsg` header. This discrepancy allows an out-of-bounds write of approximately 12 bytes. On systems with `CONFIG_USERSPACE` enabled, an unprivileged userspace thread can trigger this to corrupt kernel heap memory. The vulnerability is reachable via UDP/IP sockets when features like `IP_PKTINFO`, `IPV6_RECVPKTINFO`, or hardware timestamping are enabled and the application provides an undersized control buffer. The fix involves using `NET_CMSG_SPACE` to properly account for both header and data alignment.
Affected products
- Zephyr Project Zephyr RTOS v3.6.0 through v4.4.0
Timeline
- 2026-06-28: advisory: Vulnerability published and CVE-2026-10643 assigned.
- 2026-06-28: patched: Fix committed to Zephyr main branch.