CVE-2026-15924: Zephyr TLS socket layer race condition in session cache

CVE-2026-15924 · Severity: medium · CVSS 5.9 · Published 2026-09-14

Zephyr's TLS socket library has a race condition in its client session cache that can be triggered when multiple TLS connections run concurrently. The vulnerability allows attackers (including compromised servers) to cause memory corruption and application crashes by triggering unsynchronized access to shared cache data. Organizations running Zephyr applications with client session caching enabled and concurrent TLS connections should apply the fix immediately to prevent denial of service.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-15924 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15924 being exploited in the wild.
How severe is CVE-2026-15924?
Medium severity, with a CVSS score of 5.9, published 14 September 2026.
Which products and versions are affected?
Zephyr RTOS <UNKNOWN>.
Is there a fix for CVE-2026-15924?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15924 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-15924?
Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a race condition (use-after-free and double-free) in the TLS socket layer's session cache (subsys/net/lib/sockets/sockets_tls.c). The client_cache array is shared across all TLS sockets but protected only by per-socket mutexes (ctx->lock), providing no synchronization between different sockets. When CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, concurrent reads in tls_session_get() can overlap with writes in tls_session_save(), causing one thread to dereference a freed session buffer while another thread is reallocating it. The vulnerability requires the TLS_SESSION_CACHE socket option to be explicitly enabled and concurrent TLS client connections on multiple threads; remote servers can influence timing by controlling session-ticket frequency. The impact is heap corruption and denial of service (crash). The fix adds a dedicated session_cache_lock mutex to serialize all cache accesses.

Affected products

  • Zephyr RTOS <UNKNOWN>

Timeline

  • 2026-09-14: disclosed
  • 2026-09-14: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.