Executive brief
The Zephyr real-time operating system's SDIO (Secure Digital I/O) subsystem has a vulnerability in how it handles communications with SDIO peripheral cards. When a malicious or malfunctioning SDIO card reports a maximum block size of zero, the system enters an infinite loop that freezes the thread managing that card and prevents any other operations (such as Wi-Fi functionality that depends on SDIO) from proceeding until the device is manually reset. This only affects systems with removable SDIO card slots where an attacker could physically insert a crafted card.
Technical details
The vulnerability is an infinite loop in the sdio_io_rw_extended_helper() function in subsys/sd/sdio.c. The function performs data transfers using a byte-I/O loop that calculates per-iteration transfer size as MIN(remaining, func->cis.max_blk_size). When max_blk_size is zero (decoded directly from the SDIO card's CIS FUNCE tuple without validation), the size becomes 0, remaining never decreases, and the loop spins indefinitely. The loop is reached through public SDIO client APIs (sdio_read_fifo(), sdio_write_fifo(), and register helpers) while holding the per-card mutex, causing a permanent denial of service. Attack vector is physical (inserting a crafted SDIO card); soldered peripherals are not affected. The fix validates that max_blk_size is non-zero and returns -EIO before entering the loop.
Affected products
- Zephyr Zephyr <UNKNOWN>
Timeline
- 2026-09-14: disclosed: CVE-2026-15923 published
- 2026-09-14: patched: Fix commit 3b2f7aa merged to add validation before byte-I/O loop