CVE-2026-18417: Zephyr RTOS BSD socket layer type confusion

CVE-2026-18417 · Severity: medium · CVSS 6.5 · Published 2026-09-29

Zephyr RTOS's BSD socket implementation stores error codes in a shared data field that is also used by the network stack to pass context pointers. When a listening TCP socket's network interface goes down repeatedly, the stale error code can be dereferenced as a pointer, causing the kernel to crash. An attacker with local access or the ability to repeatedly trigger link-down events (such as disrupting a wireless link) can force a system reboot.

Vendors: Nordic Semiconductor.

Quick answers

Is CVE-2026-18417 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18417 being exploited in the wild.
How severe is CVE-2026-18417?
Medium severity, with a CVSS score of 6.5, published 29 September 2026.
Which products and versions are affected?
Nordic Semiconductor Zephyr RTOS v4.3.0, v4.3.1, v4.4.x.
Is there a fix for CVE-2026-18417?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18417 attacked?
It is attacked with local access or from the adjacent network, in an operating system.
Am I affected by CVE-2026-18417?
Check whether you run Nordic Semiconductor Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A type-punning vulnerability in the BSD socket layer (subsys/net/lib/sockets/sockets_inet.c) stores asynchronous socket errors as integers in struct net_context's void user_data field, which is normally owned by the network stack to hold context pointers for TCP accept callbacks. On v4.3.0, a second interface-down event reuses the poisoned field, causing zsock_accepted_cb() to dereference a small errno value as a struct pointer, performing arbitrary stores through the corrupted address. Later versions (v4.3.1+) disarm the callback but leave a narrower race condition and allow getsockopt(SO_ERROR) to leak kernel addresses to userspace.

Affected products

  • Nordic Semiconductor Zephyr RTOS v4.3.0, v4.3.1, v4.4.x

Timeline

  • 2026-09-29: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.