Executive brief
Zephyr's TLS credential storage system, used for secure network connections, contains a mutex (lock) that is not properly initialized. When multiple operations try to access credentials simultaneously—such as multiple network connections being established at the same time or credential management happening during a connection—the system crashes with a kernel panic, making the device unavailable until restarted.
Technical details
The vulnerability is an uninitialized mutex in the PSA Protected Storage credential backend (tls_credentials_trusted.c). The credential_lock mutex is declared as a static zero-filled struct without calling k_mutex_init(), leaving its internal wait queue with NULL pointers. Under contention, k_mutex_lock() attempts to append to the wait queue via sys_dlist_append(), dereferencing the NULL tail pointer and causing a kernel panic. The defect is latent on the fast path but deterministically triggers when two execution contexts contend for the lock, such as during concurrent TLS handshakes or concurrent credential operations with handshakes. The fix is to initialize the mutex statically using K_MUTEX_DEFINE(credential_lock). Impact is limited to builds with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE enabled; the default volatile RAM backend is unaffected.
Affected products
- Zephyr Project Zephyr affected versions with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE enabled
Timeline
- 2026-08-12: disclosed