Executive brief
Zephyr's TLS socket library has a race condition in its client session cache that can be triggered when multiple TLS connections run concurrently. The vulnerability allows attackers (including compromised servers) to cause memory corruption and application crashes by triggering unsynchronized access to shared cache data. Organizations running Zephyr applications with client session caching enabled and concurrent TLS connections should apply the fix immediately to prevent denial of service.
Technical details
The vulnerability is a race condition (use-after-free and double-free) in the TLS socket layer's session cache (subsys/net/lib/sockets/sockets_tls.c). The client_cache array is shared across all TLS sockets but protected only by per-socket mutexes (ctx->lock), providing no synchronization between different sockets. When CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, concurrent reads in tls_session_get() can overlap with writes in tls_session_save(), causing one thread to dereference a freed session buffer while another thread is reallocating it. The vulnerability requires the TLS_SESSION_CACHE socket option to be explicitly enabled and concurrent TLS client connections on multiple threads; remote servers can influence timing by controlling session-ticket frequency. The impact is heap corruption and denial of service (crash). The fix adds a dedicated session_cache_lock mutex to serialize all cache accesses.
Affected products
- Zephyr RTOS <UNKNOWN>
Timeline
- 2026-09-14: disclosed
- 2026-09-14: advisory