# CVE-2026-10655: Zephyr RTOS use-after-free in SNTP asynchronous client

Source: https://junglewise.ai/threats/cve-2026-10655-zephyr-rtos-use-after-free-in-sntp-asynchronous-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-10655 · Severity: medium · CVSS 6.5 · Published 2026-06-30

Zephyr is an open-source operating system designed for resource-constrained IoT devices. A flaw in its time-synchronization client (SNTP) could allow a remote attacker to crash a device by interfering with network timing responses. This could lead to a denial-of-service state or unpredictable behavior in connected industrial or consumer hardware.

Technologies: [Zephyr Project Zephyr](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-10655 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10655 being exploited in the wild.

**How severe is CVE-2026-10655?** Medium severity, with a CVSS score of 6.5, published 30 June 2026.

**Which products and versions are affected?** Zephyr Project Zephyr 4.2.0 to 4.4.0.

**Is there a fix for CVE-2026-10655?** A patch was published on 2026-05-01: Fix commit ef47bdf authored Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10655 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-10655?** Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the Zephyr SNTP client (subsys/net/lib/sntp/sntp.c) due to a lack of synchronization between the calling thread and the socket-service poll thread. When 'sntp_close_async' is invoked (typically during a timeout), it closes the UDP socket file descriptor and frees the underlying 'net_context' while the socket service thread may still be polling it. Because 'net_context' objects are allocated from a fixed pool and reused, this leads to object confusion or a kernel crash. An off-path attacker can trigger this race by dropping or delaying SNTP responses. The issue is resolved by deferring the socket close operation to the socket service thread itself.

## Affected products

- zephyrproject zephyr 4.2.0 to 4.4.0

## Timeline

- 2026-06-30: advisory: GHSA-34wr-cg29-c4mw published
- 2026-06-30: disclosed
- 2026-05-01: patched: Fix commit ef47bdf authored

## References

- [https://github.com/zephyrproject-rtos/zephyr](https://github.com/zephyrproject-rtos/zephyr)
- [https://github.com/zephyrproject-rtos/zephyr/commit/ef47bdf328b4206ac3b3922ec09184f7a6f7412a](https://github.com/zephyrproject-rtos/zephyr/commit/ef47bdf328b4206ac3b3922ec09184f7a6f7412a)
- [https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-34wr-cg29-c4mw](https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-34wr-cg29-c4mw)

## Related threats

- [Zephyr UART wide-data syscall verifier NULL pointer dereference](https://junglewise.ai/threats/cve-2026-90834-the-user-mode-syscall-verifiers-for-the-16-bit-wide-data-uart-api)
- [Zephyr PTP port unvalidated logMessageInterval denial of service](https://junglewise.ai/threats/cve-2026-87042-the-ieee-1588-ptp-port-implementation-in-subsys-net-lib-ptp-port)
- [Zephyr HTTP server HTTP/2 buffer overflow via static file serving](https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection)
- [Zephyr OpenThread hardcoded default joiner credential](https://junglewise.ai/threats/cve-2026-19741-zephyr-s-openthread-integration-defined-config-openthread-joiner)
- [Zephyr ARM64 MMU ASID allocation collision in memory domain isolation](https://junglewise.ai/threats/cve-2026-19574-the-arm64-mmu-back-end-allocated-address-space-identifiers-asids)