Executive brief
An MQTT-SN client in Zephyr RTOS contains a bug in its keepalive handler that can be triggered remotely by a malicious or failing gateway. When the gateway stops responding to keepalive requests, the client attempts to clean up its gateway record but dereferences a NULL pointer instead, causing a kernel crash or memory corruption. An attacker can exploit this by impersonating a gateway and stopping responses, resulting in a denial of service that prevents the affected IoT device from communicating.
Technical details
The vulnerability is a NULL pointer dereference in process_ping() within subsys/net/lib/mqtt_sn/mqtt_sn.c. The root cause is improper use of the SYS_SLIST_PEEK_HEAD_CONTAINER() macro: the return value is not assigned to the gateway pointer variable, leaving it NULL regardless of whether the list contains entries. When PINGREQ retries are exhausted (a condition controlled by the remote peer), the code attempts to destroy the gateway record by dereferencing the NULL pointer (gw->gw_id) and calling mqtt_sn_gw_destroy(). This leads to a call to k_mem_slab_free(&gateways, NULL), which either triggers a kernel panic if CONFIG_MEM_SLAB_POINTER_VALIDATE is enabled, or corrupts the slab allocator's free list on systems where NULL is writable. Attack vector is network-based via UDP; no authentication is required. A malicious gateway, compromised gateway, or on-path attacker can trigger this by advertising as a gateway and ceasing to respond to PINGREQs. The fix involves correctly assigning the macro's return value to the gateway pointer.
Affected products
- Zephyr Project Zephyr RTOS <UNKNOWN>
Timeline
- 2026-09-13: disclosed: CVE-2026-15891 published
- 2026-09-13: other: Not reported exploited in wild